Highland Software Custom Role Manager CVE-2026-7106

Exploitation requires the Highland Software Custom Role Manager plugin version 1.0.0 or earlier to be installed and activated on the target WordPress site. The attacker must possess valid credentials for any authenticated user role-Subscriber, Contributor, Author, Editor, or Administrator-though the vulnerability's significance lies in Subscriber-level accounts being sufficient. WordPress sites with user registration disabled still face risk if any existing low-privilege account is compromised. The personal_options_update action hook fires on all profile updates in WordPress core, making this vulnerability exploitable on default WordPress configurations without requiring non-standard settings. No special plugin configurations, server-side conditions, or WordPress multisite requirements exist-any standard WordPress installation with the plugin active is vulnerable through the standard profile update form accessible at /wp-admin/profile.php.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) accurately reflects the technical severity: network-accessible, low complexity, requiring only low privileges (Subscriber account) with no user interaction needed. The attack provides complete scope for confidentiality, integrity, and availability compromise since WordPress Administrator role grants full site control including plugin installation, theme modification, and database access. However, real-world risk depends heavily on deployment context. Exploitation requires an existing authenticated account, limiting impact to sites with open registration or compromised Subscriber credentials. The absence of CISA KEV status and lack of provided EPSS score suggests this is not yet widely exploited in the wild, likely due to the plugin's limited installation base compared to major WordPress plugins. Organizations running this specific plugin face CRITICAL risk since any low-privilege account becomes an instant admin. Those not using Highland Software Custom Role Manager face zero risk despite the high CVSS-this is a targeted plugin vulnerability, not a WordPress core issue.

An attacker registers a free Subscriber account on a WordPress site running the vulnerable plugin (or compromises an existing low-privilege account via credential stuffing). They navigate to their profile page at wp-admin/profile.php and intercept the profile update request using browser developer tools or a proxy like Burp Suite. The attacker adds a manipulated hscrm_user_roles parameter to the POST request, setting their role to 'administrator'. When they submit the profile update, hscrm_save_user_roles() processes the role change without verifying current_user_can('edit_users'), instantly granting full administrative privileges. The attacker now controls the entire WordPress installation, can install backdoor plugins, exfiltrate data, or deface the site.