What is the CVSS score of CVE-2026-7106?

CVE-2026-7106 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Highland Software Custom Role Manager are affected by CVE-2026-7106?

Highland Software Custom Role Manager for WordPress (versions prior to 1.0.1) contains a privilege escalation vulnerability allowing authenticated subscribers to elevate themselves to administrator,…

How to fix or mitigate CVE-2026-7106?

Within 24 hours: Inventory all WordPress installations using Highland Software Custom Role Manager and document current version numbers. Within 7 days: Update Custom Role Manager to version 1.0.1 or later on all affected instances; verify update success by checking plugin version in WordPress admin. Within 30 days: Conduct access logs review for the prior 90 days to identify any unauthorized role changes or administrative account creations; reset passwords for all user accounts as a precautionary measure.

Highland Software Custom Role Manager CVE-2026-7106

EUVD-2026-25769 HIGH

Improper Privilege Management (CWE-269)

2026-04-27 Wordfence

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 18:52 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 03:30 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 03:00 euvd

EUVD-2026-25769

Analysis Generated

Apr 27, 2026 - 03:00 vuln.today

CVE Published

Apr 27, 2026 - 02:26 nvd

HIGH 8.8

DescriptionCVE.org

The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.

AnalysisAI

Authenticated attackers with Subscriber-level privileges can escalate to Administrator role in Highland Software Custom Role Manager for WordPress via profile update exploitation. The hscrm_save_user_roles() function lacks capability checks on the personal_options_update hook, allowing low-privilege users to modify arbitrary user roles including their own. Version 1.0.1 released with authorization fixes. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. EPSS data not provided, no CISA KEV listing identified, indicating limited widespread exploitation despite the severity of self-service privilege escalation to site administrator.

Technical ContextAI

WordPress action hooks like personal_options_update trigger when any authenticated user updates their profile. The vulnerability stems from CWE-269 (Improper Privilege Management) where the plugin's hscrm_save_user_roles() function processes role modification requests without verifying the current_user_can('edit_users') or similar capability checks. In WordPress's privilege model, Subscribers (the lowest authenticated role) can access profile updates but should never modify user roles-a permission reserved for Administrators. The affected CPE (cpe:2.3:a:jgrodgers:highland_software_custom_role_manager) identifies this as a third-party WordPress plugin by developer jgrodgers. Source code references point to user-ui.php lines 203, 223, and 289 in version 1.0.0 where the vulnerable function hooks into WordPress core actions without proper authorization gates.

RemediationAI

Upgrade immediately to Highland Software Custom Role Manager version 1.0.1, which implements authorization checks in user-ui.php line 203 and related functions per the plugin repository diff at https://plugins.trac.wordpress.org/browser/highland-software-custom-role-manager/tags/1.0.1/includes/user-ui.php#L203. If immediate upgrade is not possible, disable the Highland Software Custom Role Manager plugin entirely until patching-this removes all role management functionality but eliminates the privilege escalation vector. For sites requiring role management during the interim, switch to established alternatives like User Role Editor or Members plugins that have mature security track records. Audit all user accounts for unexpected role changes by reviewing WordPress user lists for Subscribers or Contributors who gained Administrator privileges since plugin installation. Check wp_usermeta table for role modifications if forensic investigation is needed. Do not attempt to patch the vulnerability manually by editing plugin files, as this creates maintenance debt and may be overwritten by auto-updates.