davefx CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH davefx CVE published 2026-10-14

CVE-2026-104767

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. Authenticated attackers with subscriber-level access and above can restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event.