CVE-2026-7106
Published: 27 April 2026
Summary
CVE-2026-7106 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-7106 is a privilege escalation vulnerability affecting the Highland Software Custom Role Manager plugin for WordPress in versions up to and including 1.0.0. The issue stems from insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action and thus accessible by any authenticated user. This flaw, published on 2026-04-27, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management).
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability by submitting modified data via the profile update form, potentially altering user roles. Successful exploitation enables privilege escalation, allowing low-privileged users to elevate their access or manipulate roles of other users, leading to high confidentiality, integrity, and availability impacts.
References provided in the CVE point to specific lines in the plugin's user-ui.php file across versions, including lines 203, 223, and 289 in tag 1.0.0, line 203 in tag 1.0.1, and line 203 in the trunk. These code excerpts indicate that mitigation involves updating to version 1.0.1 or later, where authorization checks have been addressed in the affected function.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25769
Vulnerability details
The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible…
more
by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables authenticated role modification via insufficient authorization in WordPress plugin, directly mapping to exploitation for privilege escalation (T1068) and account manipulation to elevate or alter roles (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for role modifications, addressing the insufficient authorization checks in the hscrm_save_user_roles() function.
Enforces least privilege to restrict user role changes to only authorized high-privilege accounts, preventing escalation from Subscriber-level access.
Requires timely remediation of the plugin flaw by updating to version 1.0.1 or later, where authorization checks are implemented.