CVE-2026-104767

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybe add role to user() function unconditionally re-assigning every role stored in the dfxwcrc foreign roles user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by remember foreign roles(), which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that administrator was written into the dfxwcrc foreign roles user meta cache before the external provider revoked it.