Membership User Roles For Woocommerce Automatic Role Changer
Monthly
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.