{"id":"CVE-2026-119075","published":"2026-11-07T12:17:44.033","lastModified":"2026-11-07T19:17:19.637","description":"The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L354","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L407","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.4&new_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.5","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/714d10b0-526c-4347-a369-85fc32ef3478?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Registration Form for WooCommerce plugin (≤1.1.4) lacks role validation in the checkout registration path, allowing unauthenticated attackers to inject arbitrary user roles via POST data during checkout. This bypasses the allow-list check used in the My Account registration flow and enables privilege escalation to Administrator.","exploitability":"Exploitation is trivial for unauthenticated attackers with no prerequisites beyond access to the WooCommerce checkout page; it requires only sending a single HTTP POST request with user_roles=administrator.","blast_radius":"Successful exploitation grants full administrative control of the WordPress site, enabling complete data exfiltration, malware deployment, or site defacement.","remediation":"Upgrade to Registration Form for WooCommerce version 1.1.5 or later, which enforces role allow-listing in the checkout registration path.","detection":"Defenders should monitor WooCommerce checkout POST requests for unexpected 'user_roles' parameters containing privileged roles (e.g., administrator, editor); such requests are anomalous since legitimate checkout flows do not submit user role data. Log entries showing new user creation with non-default roles via checkout-triggered events may also indicate exploitation.","tags":["privilege-escalation","auth-bypass","woocommerce","web-app","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:46:07.777Z"}}