CVE-2026-104767: Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser() function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by rememberforeignroles(), which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that administrator was written into the dfxwcrcforeignroles user meta cache before the external provider revoked it.
Affected Software
Event History
Frequently Asked Questions
Which sites are realistically exposed to privilege escalation?
Sites are exposed only if Replace Roles mode is enabled and a user previously received the Administrator role through a separate role-management mechanism while the plugin was active. That prior Administrator assignment must have been retained in the user's dfxwcrc_foreign_roles cache after the external provider revoked it.
What does an attacker need to exploit this issue?
The attacker needs an authenticated account with at least Subscriber-level access, a stale cached Administrator role for that same account, and a way to trigger a role-assignment event. Completing a purchase for a role-mapped product is one example of such an event.
Are users who never previously had Administrator access affected?
The described escalation path depends on administrator having previously been written to the user's foreign-role cache. The provided information does not describe a way for a user without that prior legitimate Administrator assignment to create the required stale cache entry.
How can administrators identify accounts at risk?
Review user meta caches named dfxwcrc_foreign_roles for accounts containing administrator, particularly where that role was revoked by the external provider. Also verify whether Replace Roles mode is enabled and whether affected users can trigger role-mapping events.