CVE-2026-7106

High

Published: 27 April 2026

Published

27 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0005 17.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7106 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Directly enforces approved authorizations for role modifications, addressing the insufficient authorization checks in the hscrm_save_user_roles() function.

AC-6 Least Privilege good match

prevent

Enforces least privilege to restrict user role changes to only authorized high-privilege accounts, preventing escalation from Subscriber-level access.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of the plugin flaw by updating to version 1.0.1 or later, where authorization checks are implemented.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

Why these techniques?

Vulnerability enables authenticated role modification via insufficient authorization in WordPress plugin, directly mapping to exploitation for privilege escalation (T1068) and account manipulation to elevate or alter roles (T1098).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible…

by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.

Deeper analysisAI

CVE-2026-7106 is a privilege escalation vulnerability affecting the Highland Software Custom Role Manager plugin for WordPress in versions up to and including 1.0.0. The issue stems from insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action and thus accessible by any authenticated user. This flaw, published on 2026-04-27, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management).

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability by submitting modified data via the profile update form, potentially altering user roles. Successful exploitation enables privilege escalation, allowing low-privileged users to elevate their access or manipulate roles of other users, leading to high confidentiality, integrity, and availability impacts.

References provided in the CVE point to specific lines in the plugin's user-ui.php file across versions, including lines 203, 223, and 289 in tag 1.0.0, line 203 in tag 1.0.1, and line 203 in the trunk. These code excerpts indicate that mitigation involves updating to version 1.0.1 or later, where authorization checks have been addressed in the affected function.