CVE-2026-104767

{
  "etk_id": "ETK-2026-1862",
  "cve_id": "CVE-2026-104767",
  "display_id": "CVE-2026-104767",
  "ghsa_id": "GHSA-m963-j4qw-ph48",
  "euvd_id": "EUVD-2026-100767",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stale role cache privilege escalation in Automatic Role Changer",
  "summary": "Membership & User Roles for WooCommerce (Automatic Role Changer) through version 20260828 can retain revoked externally managed roles and later reapply them. An authenticated user may regain administrator access if Replace Roles mode is enabled and the account previously held that role before it was revoked.",
  "mitigation": "Disable Replace Roles mode or deactivate the plugin until a vendor update is available. Review affected user accounts and remove any improperly restored administrator roles.",
  "vendor": "davefx",
  "product": "Membership & User Roles for WooCommerce (Automatic Role Changer)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 20260828"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Membership & User Roles for WooCommerce (Automatic Role Changer)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0035,
  "epss_percentile": 0.2664,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 71.25288083333334,
  "t0_at": "2026-10-14T01:27:14.736000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T09:32:06.136348+00:00",
      "days": 3.3367060225462963,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T01:27:14.736000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-14T01:27:14.736000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T01:27:14.736000+00:00",
      "url": "https://github.com/advisories/GHSA-m963-j4qw-ph48"
    }
  }
}