CVE-2026-104767: WooCommerce Membership Privilege Escalation

CVE-2026-104767 Overview

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress contains a privilege escalation flaw in versions through 20260828. The vulnerability resides in the maybe_add_role_to_user() function, which re-assigns every role cached in the dfxwcrc_foreign_roles user meta without verifying the role is still active with the external provider. Authenticated attackers holding subscriber-level access or above can restore a previously revoked Administrator role by triggering any role-assignment event, such as completing a purchase for a role-mapped product. Successful exploitation grants full administrative control of the WordPress site.

Critical Impact
Authenticated users with cached Administrator history can re-elevate to full site administrator by triggering a WooCommerce role-assignment event, bypassing legitimate role revocation.

Affected Products

Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress
All versions up to and including 20260828
WordPress sites running the plugin with Replace Roles mode enabled

Discovery Timeline

2026-10-14 - CVE-2026-104767 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104767

Vulnerability Analysis

The flaw is an Improper Privilege Management issue [CWE-269] in the plugin's foreign-role caching logic. The plugin maintains a persistent cache of previously assigned roles in the dfxwcrc_foreign_roles user meta key. When a role-assignment event fires, maybe_add_role_to_user() iterates the cached entries and reapplies each one to the user without checking whether the external provider still authorizes those roles.

The remember_foreign_roles() helper merges newly observed roles into the cache but never removes revoked entries. As a result, any role ever written to the cache, including administrator, remains eligible for silent re-application. The vulnerability affects integrity, confidentiality, and availability because an attacker with administrator rights can modify content, read sensitive data, and disable the site.

Root Cause

The root cause is a stale authorization cache. The plugin treats cached role entries as the source of truth during re-assignment rather than reconciling against the external provider's current authoritative state. Combined with the merge-only behavior of remember_foreign_roles(), revoked privileges are never evicted from the user meta.

Attack Vector

Exploitation requires three preconditions: an authenticated account at subscriber level or above, Replace Roles mode enabled in the plugin configuration, and prior legitimate assignment of the Administrator role while the plugin was active so that administrator was written into dfxwcrc_foreign_roles. Once these conditions are satisfied, the attacker triggers any role-assignment event, such as completing a purchase for a role-mapped product, to force maybe_add_role_to_user() to re-apply the cached Administrator role. No social engineering or victim interaction is required.

The vulnerable code paths are documented in the plugin source at WordPress Plugin Code Line 351, Line 414, Line 427, and Line 468.

Detection Methods for CVE-2026-104767

Indicators of Compromise

User accounts that previously held the Administrator role and now re-acquire it after a WooCommerce order completion or product purchase event.
The presence of administrator in the dfxwcrc_foreign_roles user meta for non-administrative accounts.
Unexpected set_role or add_role calls targeting subscriber-level accounts in WordPress audit logs.
Administrator-tier actions, such as plugin installs or option changes, originating from accounts normally restricted to shop or subscriber roles.

Detection Strategies

Audit the WordPress usermeta table for entries where meta_key = 'dfxwcrc_foreign_roles' and the stored value includes administrator for accounts that are not currently expected to be administrators.
Correlate WooCommerce order completion events with WordPress role-change events on the same user ID within a short time window.
Review plugin changeset history at WordPress Plugin Changeset Review to confirm the installed version is beyond the vulnerable release.

Monitoring Recommendations

Alert on any transition of a subscriber or customer account to the Administrator role outside of documented change windows.
Monitor the WordPress wp_capabilities meta changes alongside WooCommerce transaction logs for correlation.
Track installation and activation of plugins, theme file edits, and option updates performed by recently elevated accounts.

How to Mitigate CVE-2026-104767

Immediate Actions Required

Update the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin to a version released after 20260828 that evicts revoked roles from the dfxwcrc_foreign_roles cache.
Review all WordPress user accounts for unexpected Administrator role assignments and remove them.
Clear the dfxwcrc_foreign_roles user meta entries for all non-administrative accounts to purge stale cached privileges.
Rotate credentials and application passwords for any accounts that previously held Administrator access.

Patch Information

Refer to the Wordfence Vulnerability Report for patched version details and the WordPress Plugin Changeset Review for the specific code changes addressing the stale role cache.

Workarounds

Disable Replace Roles mode in the plugin configuration until the patched version is installed, because exploitation requires this mode to be enabled.
Deactivate the plugin on production sites where immediate update is not possible and manage WooCommerce role mappings through alternative mechanisms.
Restrict WooCommerce product purchases for role-mapped products to vetted customer accounts only.
Enforce strict separation between Administrator accounts and accounts used for purchasing or subscriber activity, preventing administrator from ever being written to the foreign-role cache.

bash

# Configuration example: audit vulnerable user meta via WP-CLI
wp user meta list --fields=user_id,meta_key,meta_value \
  | grep dfxwcrc_foreign_roles

# Remove stale cached roles for a specific non-admin user
wp user meta delete <user_id> dfxwcrc_foreign_roles