Membership & User Roles for WooCommerce (Automatic Role Changer)

Membership & User Roles for WooCommerce (Automatic Role Changer) has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Improper Privilege Management, behind 1 of the records (100%).

The one issue recorded for Membership & User Roles for WooCommerce (Automatic Role Changer) has a vendor fix available, so running the current release closes it.

All of these findings were reported by Azgnt. Membership & User Roles for WooCommerce (Automatic Role Changer) is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Membership & User Roles for WooCommerce (Automatic Role Changer) vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-104767

Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache

Read the full analysis

Vulnerability Records

1 records
Membership & User Roles for WooCommerce (Automatic Role Changer) banner
Latestv20261008

Membership & User Roles for WooCommerce (Automatic Role Changer)

David Marín Carreño (DaveFX)

Author

David Marín Carreño (DaveFX)

4.3(6)
86/100
Last Updated
2026-10-08 (11d ago)
Active Installs
300+
Downloads
8,462
Requires WP
6.2+
Requires PHP
8.0+
Tested up to
WP 7.1.3
Created
2020-11-17 (6y ago)
Requires Plugins
woocommerce

Sync user roles with memberships and subscriptions. Grant access on purchase, revoke on expiry, and restrict your store by role. Overview The Membership & User Roles for WooCommerce plugin automates the assignment of user roles based on product purchases. This powerful tool streamlines store management by ensuring users are automatically assigned the appropriate roles, enhancing membership sites, subscription-based models, and more. It also bridges MemberPress to WordPress roles: a membership’s state drives the role, continuously, so access granted in MemberPress is reflected wherever your site checks roles. Features Automatically assign roles to users upon product purchase. Integrates seamlessly with WooCommerce. Syncs MemberPress membership state to WordPress roles, continuously — the direction other integrations don’t cover. The free version syncs one membership level. Premium: Supports the definition of different roles for variations in variable products. Premium: Allows defining, per product, a role validity period in days after the purchase, so the role granted in the purchase will be automatically removed after that period. Premium: Supports role management tied to subscription products, supporting WooCommerce Subscriptions, YITH WooCommerce Subscription and WP Swings Subscriptions for WooCommerce. Premium: Allows defining multiple roles per product. Premium: Unlimited MemberPress levels, several roles per membership, and mapping of every membership state (pending, active, suspended, cancelled, expired). Premium: Restricts your store by role — hides products and categories from the catalog and search, denies direct URL access, blocks add-to-cart, and sets per-role prices, payment gateways and shipping methods. Premium: Retroactive sync — a batched admin tool that aligns the roles of members who already existed before the mapping was configured. Safe to re-run. Configuration Setting Up Role Assignments Edit a product from your catalog. Choose the role (or several roles PREMIUM) to assign when the product is purchased. Premium: Define a role validity period in days after the purchase. In WooCommerce > Settings > Role Changer you can configure advanced settings to fine-tune role assignments, such as defining if the new role must be added to the user, or if the new role should just replace the previous one. Save changes. Premium Features Define Role Validity Periods The premium version allows defining a role validity period in days after the purchase. The role granted in the purchase will be automatically removed after that period. Manages roles following the lifecycle of subscription products The premium version supports advanced functionality for subscription products, supporting WooCommerce Subscriptions, YITH WooCommerce Subscription and WP Swings Subscriptions for WooCommerce, assigning roles based on subscription status: Active: Assigns a role when a subscription is activated. Suspended: Updates the user role if a subscription is suspended, or is waiting for renewal. Cancelled: Removes or changes roles when a subscription ends. How to Enable Purchase the premium version of the plugin via the official site Upload and activate the premium plugin. Navigate to WooCommerce > Settings > Role Changer. Enable subscription-based role assignments. Troubleshooting Common Issues Issue: Role changes are not applied after purchase. Solution: Ensure the plugin is activated and configured correctly under WooCommerce > Settings > Role Changer. Issue: Subscription-based role changes are not working. Solution: Verify that the premium version is installed and active. Issue: Conflicts with other plugins. Solution: Disable other role management plugins to check for compatibility issues. Support For support, visit the plugin support forum. License This plugin is distributed under the GNU General Public License v3. For details, refer to the license file included with the plugin. Credits Author: David Marín Carreño Website: https://davefx.com/en/wordpress-plugins

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C