User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF

An attacker crafts a malicious page or link that, when visited by an authenticated WordPress administrator, silently submits a forged request to the plugin's role-capability update endpoint. Because the plugin does not include a CSRF token or other anti-forgery mechanism [CWE-352], the browser automatically attaches the victim's session cookies, causing the server to process the attacker's desired capability changes. This enables the attacker to escalate privileges of any role (e.g., promoting a low-privileged user to administrator) without the victim's knowledge or consent [ref_id=1].

The advisory does not specify the exact file or function at fault. The vulnerable code is the handler that processes role capability update requests in the User Role by BestWebSoft plugin prior to version 1.6.7 [ref_id=1].

The advisory states the vulnerability is fixed in version 1.6.7 [ref_id=1], but no patch diff is provided in the bundle. The fix likely introduces CSRF nonce verification on the role-capability update request handler, ensuring that only requests originating from the legitimate plugin admin page (where the nonce is embedded) are accepted. Without the patch source, the exact implementation cannot be confirmed.