# WooCommerce Blacklist in 'map_meta_cap' leads to Privilege Escalation of Shopmanagers

WooCommerce's map_meta_cap blacklist only blocks editing admins, letting Shop managers assign any non-admin role (e.g. editor) to users and escalate via stored XSS.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: simonscannell
- Disclosed: 2019-12-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/403039
- Library page: https://bugbountylibrary.com/r/h1%3A403039
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:chained technique:source-review vuln:access-control vuln:privilege-escalation vuln:xss

**Target:** WordPress plugin WooCommerce role/capability system
**Root cause:** wc_modify_map_meta_cap uses a blacklist that only denies editing users with the administrator role, so Shop managers retain edit_users and can assign any other role, including roles with unfiltered_html or backup privileges.
**Steps:**
1. Log in as a Shop manager.
2. Pick a random user (e.g. a customer) and set their role to editor via the user edit screen.
3. Change that user's password.
4. Log in as that user.
5. Create a post containing a JavaScript payload to trigger stored XSS against an admin.
**How found:** Code review of the Shop manager role definition revealed edit_users, then reading wc_modify_map_meta_cap showed it only blocks targets with the administrator role, prompting the hypothesis that any other privileged role could be assigned.
**Exploitation:** A compromised Shop manager account assigns the editor role (which has unfiltered_html) to a controlled user, resets the password, logs in, and posts JavaScript that executes in an admin's browser, yielding admin compromise.
**Escalation:** Chains role assignment to editor for unfiltered_html, then stored XSS to reach administrator; also can assign custom roles like BackWPup Admin to download backups.
**Insight:** When a capability filter uses a blacklist (deny only 'administrator'), enumerate every other role on the install, including plugin-registered roles with sensitive caps like unfiltered_html or backup access, as escalation targets.