Registration Form for WooCommerce: Privilege escalation vulnerability (CVE-2026-119075)

Registration Form for WooCommerce versions 1.1.4 and earlier contain a critical privilege escalation vulnerability (CVE-2026-119075). The issue exists within the FormHandler::validate_checkout_fields() function, which fails to enforce an allow-list on the user_roles parameter during the checkout registration process. This allows an unauthenticated user to inject arbitrary role values, such as 'administrator', into the woocommerce_new_customer_data array, resulting in unauthorized account creation with elevated privileges.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative access to the WordPress site, leading to full site takeover.

Recommendation

• Update the "Registration Form for WooCommerce" plugin to the latest version once a patch is released.
• Review user account creation logs for suspicious activity involving administrative roles created during the checkout process.
• Audit existing user accounts for unauthorized assignments of the Administrator role.