CVE-2020-35935 : What You Need to Know

The Advanced Access Manager plugin before 6.6.2 for WordPress is vulnerable to privilege escalation via a specific POST parameter, potentially leading to unauthorized access.

Understanding CVE-2020-35935

This CVE identifies a security issue in the Advanced Access Manager plugin for WordPress that allows privilege escalation through profile updates.

What is CVE-2020-35935?

The vulnerability in the Advanced Access Manager plugin could be exploited to escalate privileges by manipulating the aam_user_roles POST parameter when Multiple Role support is active.

The Impact of CVE-2020-35935

The vulnerability poses a high risk, with a CVSS base score of 7.5, affecting confidentiality, integrity, and availability of the system. Attackers could potentially gain unauthorized access to sensitive information.

Technical Details of CVE-2020-35935

The technical aspects of the CVE provide insight into the vulnerability and its implications.

Vulnerability Description

The flaw in the Advanced Access Manager plugin allows attackers to elevate their privileges by exploiting the aam_user_roles POST parameter during profile updates.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions: All versions before 6.6.2 are affected

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Impact: High impact on confidentiality, integrity, and availability

Mitigation and Prevention

Protecting systems from CVE-2020-35935 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update the Advanced Access Manager plugin to version 6.6.2 or newer
Disable Multiple Role support if not essential
Monitor user roles and permissions closely

Long-Term Security Practices

Regularly audit and review user roles and privileges
Implement least privilege access controls
Educate users on secure profile management

Patching and Updates

Apply security patches promptly
Stay informed about plugin updates and security advisories