CVE-2026-104767: CWE-269 Improper Privilege Management in davefx Membership & User Roles for WooCommerce (Automatic Role Changer)

CVE-2026-104767 is a privilege escalation vulnerability in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress, affecting versions up to and including 20260828. The vulnerability is due to the `maybe_add_role_to_user()` function, which reassigns every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying if each cached role is still actively assigned by the external provider. The cache is permanently merged with new foreign roles by `remember_foreign_roles()` but never removes revoked roles. This allows an authenticated user with subscriber-level access or above to restore a previously revoked Administrator role by triggering any role-assignment event, such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode enabled and that the attacker’s account had previously received the Administrator role legitimately while the plugin was active, so that the Administrator role was cached before revocation.

Successful exploitation allows an authenticated attacker with subscriber-level access or higher to regain full administrative privileges on the WordPress site, resulting in complete control over the site. This includes the ability to modify site content, settings, and user roles, potentially leading to site compromise, data theft, or persistent backdoors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable Replace Roles mode if enabled and monitor role assignment events carefully. Restrict subscriber-level user capabilities and review user roles for any unexpected privilege escalations. Follow vendor advisories for updates and apply official patches once released.