The vulnerability permits an authenticated user with subscriber or higher role to elevate privileges by restoring a previously revoked Administrator role, a CWE-269: Improper Privilege Management flaw. The flaw lies in the plugin’s role reassignment logic, which reassigns every role stored in a cached user meta field without verifying current assignment status. An attacker who had previously been granted the Administrator role by the plugin can later trigger a role‑assignment event, such as completing a purchase, to cause the cached role to be reapplied, resulting in full administrative control of the site.

davefx Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress, all releases up to and including 2026‑08‑28.

The CVSS score of 7.5 indicates a high likelihood of a serious attack. EPSS is below 1 %, showing low yet non‑zero risk of exploitation to date. The vulnerability is not listed in the KEV catalog. The attack vector requires the attacker to be authenticated and possess the subscriber role or greater, with the Replace Roles mode enabled. Additionally, the attacker’s account must have previously held the Administrator role while the plugin was active, so that the role was cached. Under these conditions, the flaw can be exploited without additional privileges, leading to a complete loss of site security.