CVE-2024-13835: Post Meta Data Manager Privilege Escalation

CVE-2024-13835 Overview

CVE-2024-13835 is a privilege escalation vulnerability in the Post Meta Data Manager plugin for WordPress. The flaw affects all versions up to and including 1.4.4. The plugin fails to verify whether a WordPress multisite installation exists before allowing user meta values to be added or modified. Authenticated attackers holding Administrator-level access on one subsite can escalate privileges on other subsites within the network that would otherwise be inaccessible to them. The vulnerability is tracked under CWE-269 (Improper Privilege Management).

Critical Impact
An Administrator on a single subsite can modify user meta across the multisite network, enabling lateral privilege escalation to subsites where the attacker previously had no rights.

Affected Products

Wpexpertplugins Post Meta Data Manager plugin for WordPress, versions <= 1.4.4
WordPress multisite installations running the affected plugin
Any subsite in a network where the plugin is network-activated

Discovery Timeline

2025-03-08 - CVE-2024-13835 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13835

Vulnerability Analysis

The Post Meta Data Manager plugin exposes functionality for modifying WordPress user meta values. On a standard single-site installation, this behavior is scoped to the site's own user table. In a WordPress multisite deployment, however, user meta keys often carry site-specific role and capability data such as wp_<blog_id>_capabilities. Modifying these keys directly changes what a user can do on a given subsite.

The plugin does not check whether the current environment is a multisite installation before permitting user meta writes. It also does not restrict which meta keys an Administrator can manipulate. An Administrator on one subsite can therefore alter capability meta keys belonging to other subsites in the network, granting themselves elevated roles on those subsites.

Root Cause

The root cause is missing context validation in the plugin's user meta handling logic. The code treats an Administrator role as sufficient authorization to add or modify arbitrary user meta, without verifying that the target meta key belongs to the current site's scope. In multisite deployments, Administrator is a per-subsite role, not a network-wide role. Only Super Administrators should hold network-wide capabilities. The plugin conflates these authorization boundaries, resulting in improper privilege management [CWE-269].

Attack Vector

Exploitation requires an authenticated account with Administrator privileges on at least one subsite in the multisite network. The attacker uses the plugin's user meta interface to write a capability meta key scoped to a different subsite, assigning themselves an elevated role such as administrator on that target subsite. No user interaction is required, and the attack is delivered over the network through the standard WordPress admin interface. Verified public proof-of-concept code has not been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13835

Indicators of Compromise

Unexpected wp_<blog_id>_capabilities entries in the wp_usermeta table associating an account with roles on subsites it did not previously access
Administrator role assignments on subsites created outside the normal user provisioning workflow
Plugin-generated requests targeting user meta keys that reference a different blog_id than the site issuing the request

Detection Strategies

Audit the wp_usermeta table for capability keys that do not correspond to a user's expected subsite membership
Review WordPress activity logs for user meta modification events originating from the Post Meta Data Manager plugin
Compare current user-to-subsite role mappings against a known-good baseline exported before the plugin was installed

Monitoring Recommendations

Enable a WordPress audit logging plugin that records update_user_meta and add_user_meta calls with the invoking user and meta key
Alert on any modification of capabilities or user_level meta keys performed by non-Super-Administrator accounts
Track outbound admin-ajax and REST API requests from Administrator sessions that reference user IDs outside the current subsite

How to Mitigate CVE-2024-13835

Immediate Actions Required

Update the Post Meta Data Manager plugin to a version later than 1.4.4 once the vendor releases a patched build
Deactivate and remove the plugin from all subsites in the multisite network until a fix is available
Review all Administrator accounts across subsites and revoke any unexpected role assignments

Patch Information

As of the last NVD update on 2026-06-17, no fixed version has been listed in the advisory metadata for versions above 1.4.4. Consult the WordPress Plugin Page for the latest release and changelog information. Verify any update against the Wordfence Vulnerability Report before deploying to production multisite networks.

Workarounds

Restrict Administrator role assignments in multisite networks to trusted personnel only, since exploitation requires Administrator access on at least one subsite
Network-deactivate the plugin from the Super Admin console until a patched release is available
Apply web application firewall rules that block requests to the plugin's endpoints when the target user meta key contains a blog_id prefix different from the current site

bash

# Disable the plugin across a multisite network using WP-CLI
wp plugin deactivate post-meta-data-manager --network

# Confirm the plugin is no longer active on any subsite
wp plugin status post-meta-data-manager