Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-119075 (GCVE-0-2026-119075)

Vulnerability from cvelistv5 – Published: 2026-11-07 11:26 – Updated: 2026-11-07 18:26

Title

Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

Summary

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 18:11 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence CNA

References

4 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/regist…
https://plugins.trac.wordpress.org/browser/regist…
https://plugins.trac.wordpress.org/changeset?old_…

Impacted products

1 product

Vendor	Product	Version
themegrill	Registration Form for WooCommerce	Affected: 0 , ≤ 1.1.4 (semver)

Credits

JB Sabit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:49.846770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:31.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Registration Form for WooCommerce",
          "vendor": "themegrill",
          "versions": [
            {
              "lessThanOrEqual": "1.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JB Sabit"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted \u0027tgwcfb/user-roles\u0027 value against the form\u0027s configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST[\u0027user_roles\u0027] value in $this-\u003evalid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account\u0027s role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:30.206Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/714d10b0-526c-4347-a369-85fc32ef3478?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L354"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L407"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.4\u0026new_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.5"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T04:58:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:45:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Registration Form for WooCommerce \u003c= 1.1.4 - Unauthenticated Privilege Escalation to \u0027user_roles\u0027 Parameter at Checkout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-119075",
    "datePublished": "2026-11-07T11:26:30.206Z",
    "dateReserved": "2026-10-29T13:06:26.068Z",
    "dateUpdated": "2026-11-07T18:26:31.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54807 (GCVE-0-2026-54807)

Vulnerability from cvelistv5 – Published: 2026-06-17 09:51 – Updated: 2026-06-17 12:15

Title

WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability