[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZvoID59fTeXK_68apNmgLM7UmaX0GZJy4v6RX8Z0eRw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-7106","highland-software-custom-role-manager-authenticated-subscriber-privilege-escalation","Highland Software Custom Role Manager \u003C= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation","The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.","highland-software-custom-role-manager",null,"\u003C=1.0.0","1.0.1","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Privilege Management","2026-04-26 14:20:30","2026-04-27 02:26:24",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F80a258a6-634c-4d7d-981f-bcbc0bb044f7?source=api-prod",1,[22,23,24,25,26,27,28],"assets\u002Fjs\u002Fhscrm-events.js","assets\u002Fjs\u002Fhscrm-ui.js","highland-software-custom-role-manager.php","includes\u002Fajax.php","includes\u002Fassets.php","includes\u002Froles.php","includes\u002Fuser-ui.php","researched",false,3,"# Research Plan: Privilege Escalation in Highland Software Custom Role Manager\n\n## Vulnerability Summary\nThe **Highland Software Custom Role Manager** plugin (\u003C= 1.0.0) contains a privilege escalation vulnerability in `includes\u002Fuser-ui.php`. The function `hscrm_save_user_roles()` is hooked to `personal_options_update`, which executes when any user updates their own profile. \n\nThe function performs an insufficient authorization check by verifying `current_user_can('edit_user', $user_id)`. In WordPress, all users (including Subscribers) have the `edit_user` capability for their own User ID. Because the function fails to check for a more restrictive capability (like `promote_users`), it allows any authenticated user to supply an array of roles via the `hscrm_roles[]` parameter, which are then assigned to their account, enabling a Subscriber to promote themselves to Administrator.\n\n## Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fprofile.php`\n- **Hook:** `personal_options_update`\n- **Required Authentication:** Subscriber or higher.\n- **Vulnerable Parameter:** `hscrm_roles[]`\n- **Security Control Bypassed:** Lack of `promote_users` or `manage_options` check in the save logic.\n\n## Code Flow\n1.  **Entry Point:** User submits the profile update form at `\u002Fwp-admin\u002Fprofile.php`.\n2.  **Hook Trigger:** WordPress triggers `personal_options_update` (for self-updates) or `edit_user_profile_update` (for admin-updates).\n3.  **Function Call:** `hscrm_save_user_roles($user_id)` is executed (`includes\u002Fuser-ui.php`).\n4.  **Auth Check (Weak):** `if (!current_user_can('edit_user', $user_id))` passes because a Subscriber can edit their own profile.\n5.  **Nonce Check:** `wp_verify_nonce(...)` validates `$_POST['hscrm_roles_nonce']` against the action `hscrm_save_user_roles`.\n6.  **Input Processing:** `$_POST['hscrm_roles']` is sanitized using `sanitize_key` but is not validated against the current user's authority to assign those roles.\n7.  **Sink:** The code (truncated in snippet, but inferred) updates the user's roles using `$user->add_role()` or `$user->set_role()` based on the provided list, which includes `administrator`.\n\n## Nonce Acquisition Strategy\nThe `hscrm_roles_nonce` is required for the exploit. This nonce is unique to the authenticated user and can be found in the HTML of the user's own profile page.\n\n1.  Log in as a Subscriber user.\n2.  Navigate to `\u002Fwp-admin\u002Fprofile.php`.\n3.  Locate the hidden input field:\n    `\u003Cinput type=\"hidden\" id=\"hscrm_roles_nonce\" name=\"hscrm_roles_nonce\" value=\"[NONCE_VALUE]\">`\n4.  Also locate the standard WordPress profile nonce `_wpnonce` (action `update-user_{ID}`) required to successfully submit the profile form.\n\n## Exploitation Strategy\n1.  **Preparation:** Use a Subscriber account.\n2.  **Information Gathering:**\n    *   Fetch `\u002Fwp-admin\u002Fprofile.php` and extract:\n        *   `hscrm_roles_nonce`\n        *   `_wpnonce`\n        *   The current user's `user_id` (usually found in the form action or a hidden input).\n3.  **Execution:** Send a POST request to `\u002Fwp-admin\u002Fprofile.php`.\n    *   **Action:** `update`\n    *   **Parameters:**\n        *   `_wpnonce`: extracted standard WP nonce.\n        *   `hscrm_roles_nonce`: extracted plugin nonce.\n        *   `from`: `profile`\n        *   `checkuser_id`: `[your_user_id]`\n        *   `user_id`: `[your_user_id]`\n        *   `nickname`: `attacker` (or any string)\n        *   `email`: `attacker@example.com`\n        *   **`hscrm_roles[]`**: `administrator`\n4.  **Verification:** Check the response for a redirect back to `profile.php?updated=1`.\n\n## Test Data Setup\n1.  **Install Plugin:** Ensure `highland-software-custom-role-manager` version 1.0.0 is active.\n2.  **Create Attacker User:**\n    ```bash\n    wp user create attacker attacker@example.com --role=subscriber --user_pass=password\n    ```\n3.  **Identify ID:**\n    ```bash\n    wp user get attacker --field=ID\n    ```\n\n## Expected Results\nA successful exploit will result in the `attacker` user being assigned the `administrator` role. The plugin's logic for multiple roles may also store these in the `hscrm_custom_roles` user meta, but the immediate WordPress `roles` array should reflect the promotion.\n\n## Verification Steps\nAfter the HTTP request, verify the promotion using WP-CLI:\n```bash\n# Check standard WordPress roles\nwp user get attacker --field=roles\n\n# Check plugin-specific custom meta\nwp user meta get attacker hscrm_custom_roles\n```\n\n## Alternative Approaches\nIf direct promotion to `administrator` is blocked by internal WP filters (unlikely in this context), try promoting to a custom role created by the plugin that has high privileges (if any exist).\n1.  Check for custom roles: `wp role list --fields=role,capabilities`\n2.  If an admin-equivalent custom role exists (e.g., `custom_manager`), use `hscrm_roles[]=custom_manager` instead.","The Highland Software Custom Role Manager plugin (\u003C= 1.0.0) is vulnerable to privilege escalation because the `hscrm_save_user_roles()` function uses a weak capability check. Authenticated users, such as Subscribers, can assign themselves the Administrator role by submitting a profile update request with the `hscrm_roles[]` parameter.","\u002F\u002F includes\u002Fuser-ui.php @ line 220\nadd_action('personal_options_update', 'hscrm_save_user_roles');\nadd_action('edit_user_profile_update', 'hscrm_save_user_roles');\nadd_action('user_register', 'hscrm_save_user_roles');\n\nfunction hscrm_save_user_roles($user_id) {\n\n    \u002F**\n     * SECURITY: Capability check\n     *\u002F\n    if (!current_user_can('edit_user', $user_id)) {\n        return;\n    }","--- includes\u002Fuser-ui.php\n+++ includes\u002Fuser-ui.php\n@@ -224,7 +224,7 @@\n     \u002F**\n      * SECURITY: Capability check\n      *\u002F\n-    if (!current_user_can('edit_user', $user_id)) {\n+    if (!hscrm_user_can_manage_roles()) {\n         return;\n     }","An authenticated attacker with Subscriber-level permissions can escalate their privileges by performing the following steps: \n1. Log in to the WordPress dashboard and navigate to the profile edit page (\u002Fwp-admin\u002Fprofile.php).\n2. Extract the 'hscrm_roles_nonce' value from the hidden input field in the page source and the standard WordPress '_wpnonce' used for profile updates.\n3. Send a POST request to \u002Fwp-admin\u002Fprofile.php with the action 'update', providing the standard nonces and setting the 'hscrm_roles[]' parameter to 'administrator'.\n4. Because the plugin only verifies if the user has the 'edit_user' capability for the targeted ID (which WordPress defaults to true for a user's own profile), the function will process the request and grant the attacker the Administrator role.","gemini-3-flash-preview","2026-04-27 13:28:51","2026-04-27 13:29:29",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","1.0.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhighland-software-custom-role-manager\u002Ftags\u002F1.0.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhighland-software-custom-role-manager.1.0.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhighland-software-custom-role-manager\u002Ftags\u002F1.0.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhighland-software-custom-role-manager.1.0.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhighland-software-custom-role-manager\u002Ftags"]