Threats Tagged 'cve-2026-104767'

The Membership & User Roles for WooCommerce (Automatic Role Changer) WordPress plugin contains a privilege escalation vulnerability in versions up to and including 20260828. The vulnerability arises because the plugin's function unconditionally reassigns cached user roles without verifying if those roles are still valid, allowing an attacker with subscriber-level access or higher to regain a previously revoked Administrator role. Exploitation requires the Replace Roles mode to be enabled and that the attacker had legitimately held the Administrator role previously while the plugin was active. This flaw can lead to full administrative control of the affected WordPress site.