Saltar al contenido
DUPIN
ALERTAS · EN VIVO
Contacto

VULNERABILIDADDetectada 14 OCT · 01:18

CVE-2026-104767 Escalada de privilegios en Membership & User Roles for WooCommerce por caché de roles obsoleta

El plugin Membership & User Roles for WooCommerce (Automatic Role Changer) para WordPress es vulnerable a escalada de privilegios en versiones hasta la 20260828 inclusive. La función maybe_add_role_to_user() reasigna sin condiciones todos los roles almacenados en la caché de user meta dfxwcrc_foreign_roles sin verificar que sigan asignados por el proveedor externo, y remember_foreign_roles() nunca elimina roles revocados. Atacantes autenticados con nivel subscriber o superior pueden restaurar en su cuenta un rol…

7.5ALTA

CVSS 3.1

  • Probabilidad de explotación0,3 %
  • Explotada activamenteNo confirmada
  • Exploit públicoNo conocido

Afectados

  • davefx Membership & User Roles for WooCommerce (Automatic Role Changer)

    hasta 20260828

Qué hacer

  1. Verificá si usás Membership & User Roles for WooCommerce (Automatic Role Changer) y en qué versión.
  2. Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
  3. Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.

Calculadora CVSS

CVSS 3.1 · 7.5 ALTA

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Vector de ataqueRed
  • Complejidad del ataqueAlta
  • Privilegios requeridosBajos
  • Interacción del usuarioNinguna
  • AlcanceSin cambio
  • ConfidencialidadAlta
  • IntegridadAlta
  • DisponibilidadAlta

Descripción original

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it.

Referencias (6)

Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.