The Highland Software Custom Role Manager plugin for WordPress suffers from improper privilege management (CWE-269) due to inadequate authorization validation in the hscrm_save_user_roles() function. This function hooks into the personal_options_update action, which any authenticated user can invoke. Consequently, authenticated users with minimal privileges (Subscriber or higher) can exploit this vulnerability to alter user roles, leading to privilege escalation. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed, and the plugin is not a cloud service.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to modify user roles, potentially granting themselves or others elevated privileges. This can lead to full compromise of the WordPress site, including unauthorized access to sensitive data, administrative functions, and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users and consider disabling or removing the Highland Software Custom Role Manager plugin if feasible. Monitor for updates from the vendor and apply patches promptly once available.