Skip to content
Threat Feed

Product

Custom Role Manager Plugin

1 brief RSS
high advisory

WordPress Custom Role Manager Plugin Privilege Escalation via CVE-2026-7106

Highland Software's Custom Role Manager plugin for WordPress, versions 1.0.0 and earlier, contains a privilege escalation vulnerability (CVE-2026-7106) that allows authenticated users with subscriber-level access to modify user roles due to insufficient authorization checks in the hscrm_save_user_roles() function.

Custom Role Manager plugin privilege-escalation wordpress cve
2r 1t 1c