Automatic Role Changer CVE-2026-104767

Exploitation requires a specific non-default state, not merely network access: (1) the plugin must be configured in 'Replace Roles' mode; (2) the attacker's account must have previously been assigned the Administrator role legitimately through a separate role-management mechanism while the plugin was active, so that administrator was written into the dfxwcrc_foreign_roles user meta cache; (3) that Administrator role must subsequently have been revoked by the external provider without the cache being evicted (the remember_foreign_roles() eviction gap); and (4) the attacker must be able to trigger a role-assignment event such as completing a purchase of a role-mapped product. Authentication at subscriber level or above is required (PR:L). These stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - are the primary factors limiting real-world exploitation and mean only former privileged users, not arbitrary subscribers, can exploit it.

This is a genuine high-integrity-impact privilege escalation (CWE-269) reported by Wordfence, but its real-world risk is materially lower than the 7.5 CVSS score suggests because of stacked preconditions. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures the high attack complexity (AC:H) and the fact that an authenticated low-privilege user (PR:L, subscriber+) can trigger it over the network, with full C/I/A impact. However, the AC:H rating understates the practical barrier: exploitation is not generic - it requires that the attacker's account *previously held Administrator legitimately* while the plugin was active (so that administrator was cached into dfxwcrc_foreign_roles), that the admin role was later revoked, AND that the site runs in 'Replace Roles' mode. No EPSS score, KEV listing, or POC was provided in the input. There is no CISA KEV entry and no public exploit identified, so there is no evidence of active exploitation. Net assessment: a real and logically sound vulnerability worth patching, but a conditional, opportunistic-to-targeted issue rather than a mass-exploitable internet-wide threat - the self-privilege-restoration angle means the attacker must already be a former admin, which limits the realistic attacker population.

A user who was once legitimately granted Administrator on a WooCommerce site running this plugin in 'Replace Roles' mode is later demoted to subscriber, but the stale administrator entry remains cached in their dfxwcrc_foreign_roles user meta. The former admin simply completes a purchase of any role-mapped product, which triggers maybe_add_role_to_user() to blindly re-assign every cached role - silently restoring their Administrator access. No public exploit code was identified at time of analysis; the attack requires only normal authenticated store interaction.