Registration Form for WooCommerce (<= 1.1.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/registration-form-for-woocommerce--1.1.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 14:44:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRegistration Form for WooCommerce: Privilege escalation vulnerability (CVE-2026-119075)https://feed.craftedsignal.io/briefs/2026-11-woocommerce-priv-esc/Sat, 07 Nov 2026 14:44:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-woocommerce-priv-esc/The Registration Form for WooCommerce plugin for WordPress contains an unauthenticated privilege escalation vulnerability in the checkout registration path, allowing attackers to assign arbitrary roles, including Administrator.Registration Form for WooCommerce versions 1.1.4 and earlier contain a critical privilege escalation vulnerability (CVE-2026-119075). The issue exists within the FormHandler::validate_checkout_fields() function, which fails to enforce an allow-list on the user_roles parameter during the checkout registration process. This allows an unauthenticated user to inject arbitrary role values, such as 'administrator', into the woocommerce_new_customer_data array, resulting in unauthorized account creation with elevated privileges.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative access to the WordPress site, leading to full site takeover.

Recommendation

  • Update the "Registration Form for WooCommerce" plugin to the latest version once a patch is released.
  • Review user account creation logs for suspicious activity involving administrative roles created during the checkout process.
  • Audit existing user accounts for unauthorized assignments of the Administrator role.
]]>criticaladvisorywordpresspluginprivilege-escalationweb-application