Compliance Impact

The vulnerability allows authenticated attackers with Subscriber-level access or higher to escalate privileges by modifying user roles. This can lead to unauthorized access to sensitive data or administrative functions.

Such unauthorized privilege escalation can impact compliance with standards like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

If exploited, this vulnerability could result in data breaches or unauthorized data modifications, potentially violating regulatory requirements for data confidentiality, integrity, and access management.

Useful 0 Not Useful 0

Executive Summary

The Highland Software Custom Role Manager plugin for WordPress has a vulnerability that allows privilege escalation. This occurs because the function hscrm_save_user_roles(), which updates user roles, does not properly check authorization. Since this function is triggered by the personal_options_update action, any authenticated user, even those with only Subscriber-level access, can potentially modify user roles through the profile update form.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact because it allows an authenticated user with low-level access (such as a Subscriber) to escalate their privileges by changing user roles. This could lead to unauthorized access to administrative functions, data modification, or other high-level actions within the WordPress site, potentially compromising the entire site’s security.

Useful 0 Not Useful 0