CVE-2024-11028

CVE-2024-11028 is an Authentication Bypass vulnerability affecting all versions up to 1.0.5 of the MultiManager WP – Manage All Your WordPress Sites Easily plugin. This flaw allows unauthenticated attackers to impersonate any existing user, including administrators, by exploiting a weakness in how the plugin determines the current user through user-supplied input. The vulnerability carries a critical CVSS score of 9.8, indicating a severe risk with a network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Attackers can exploit this without requiring any privileges or user interaction. Currently, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of reported vulnerabilities.