Privilege Escalation Vulnerability in Highland Software Custom Role Manager for WordPress

CVE-2026-7106

What is CVE-2026-7106?

The Highland Software Custom Role Manager plugin for WordPress contains a vulnerability that allows for Privilege Escalation. This issue arises from inadequate authorization checks within the hscrm_save_user_roles() function, which is triggered by the personal_options_update action. As a result, authenticated users with at least Subscriber-level access may exploit this flaw to alter user roles through the profile update form, potentially compromising user permissions and increasing security risks.

References