CVE-2026-104767 Details

A privilege escalation vulnerability has been identified in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress, affecting versions through 20260828. The issue arises because the 'maybe_add_role_to_user()' function indiscriminately reassigns all roles stored in the 'dfxwcrc_foreign_roles' user meta cache. It fails to verify whether each role is still actively assigned by the external provider, a situation that becomes permanent when 'remember_foreign_roles()' is invoked, as it adds new foreign roles to the cache without removing those that have been revoked. This flaw allows authenticated attackers with subscriber-level access or higher to restore a previously revoked Administrator role to their own account. The exploitation of this vulnerability grants full administrative control over the site. To trigger the issue, an attacker can activate any role-assignment event, such as completing a purchase for a product that is mapped to a specific role. The 'Replace Roles' mode must be enabled, and the attacker's account must have previously been assigned the Administrator role through a legitimate role-management process while the plugin was active. This ensures that 'administrator' was recorded in the 'dfxwcrc_foreign_roles' user meta cache before it was revoked by the external provider.

Users are advised to update the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin to version 20261007 or a newer patched version.