CVE-2026-104767 davefx CVE debrief

Who should care

Defenders of WordPress installations with the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin should assess exposure and verify the presence of this plugin.

Why it matters

Defenders should prioritize verifying the presence of this plugin, checking for role-assignment events, and ensuring Replace Roles mode is not enabled due to the potential for authenticated privilege escalation.

• Authenticated attackers with subscriber-level access and above can restore a previously revoked Administrator role to their own account
• Gaining full administrative control of the site by triggering any role-assignment event
• Requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately

Technical summary

The `maybe_add_role_to_user()` function unconditionally re-assigns every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism.

Defensive priority

Defenders should prioritize verifying the presence of this plugin, checking for role-assignment events, and ensuring Replace Roles mode is not enabled.

Recommended defensive actions

• Verify the presence of the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin
• Check for role-assignment events
• Ensure Replace Roles mode is not enabled
• Restrict role-assignment events to authorized users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.