CVE-2026-104767

NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-104767
CWE	https://cwe.mitre.org/data/definitions/269.html

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybe_add_role_to_user() function unconditionally re-assigning every role stored in the dfxwcrc_foreign_roles user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by remember_foreign_roles(), which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attackers account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that administrator was written into the dfxwcrc_foreign_roles user meta cache before the external provider revoked it.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Improper Privilege Management

Weakness

Potential Mitigations

References

CVE-2026-104767

Improper Privilege Management

Weakness

Potential Mitigations

Related Attack Patterns

References