Technical impact
The Highland Software Custom Role Manager plugin for WordPress is vulnerable due to an insufficient authorization check in the hscrm_save_user_roles() function. This function is hooked to the personal_options_update action, which any authenticated user can trigger. An attacker with Subscriber or higher access can therefore modify user roles through the profile update form, potentially granting themselves higher privileges or altering other users' roles, leading to full site compromise.
Affected Systems
The vulnerability affects the Highland Software Custom Role Manager plugin, version 1.0.0 and earlier, published by jgrodgers on the WordPress plugin repository. No later versions were reported to contain the flaw.
Risk and Exploitability
The CVSS score of 8.8 classifies this issue as high severity, while the EPSS score of < 1% indicates a low likelihood of exploitation as of the latest data. The vulnerability is not listed in CISA KEV. Exploitation requires a victim to be logged in with at least Subscriber privileges and to submit a profile update request; no elevation to full administrator is required to trigger the underlying issue. Once the role update is performed, the attacker can acquire any privileges granted to the new role, which poses an ongoing threat to site integrity and confidentiality.
