{"id":"CVE-2026-119075","kind":"vulnerability","aliases":["CVE-2026-119075"],"related":[],"title":"Registration Form for WooCommerce: unauthenticated checkout users can become Administrator","description":"The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.","summary":"The Registration Form for WooCommerce WordPress plugin, up to and including version 1.1.4, accepts a user_roles value at checkout without checking it against the allowed roles. An unauthenticated visitor can create an account with the administrator role and take over the whole site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"registration-form-for-woocommerce","fixed":["1.1.5"],"affected":"<= 1.1.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","registration-form-for-woocommerce","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the Registration Form for WooCommerce version; 1.1.4 and earlier are affected, 1.1.5 is fixed. WP-CLI: wp plugin get registration-form-for-woocommerce --field=version. Also look for new unexpected Administrator users (wp user list --role=administrator).","fix":"Update the Registration Form for WooCommerce plugin to 1.1.5 (WordPress admin > Plugins, or wp plugin update registration-form-for-woocommerce).","status":"open","published_at":"2026-11-07T12:17:44+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:40+00:00","updated_at":"2026-11-07T12:50:01+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-07T12:48:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Registration Form for WooCommerce: unauthenticated checkout users can become Administrator","impact":"high","summary":"The Registration Form for WooCommerce WordPress plugin, up to and including version 1.1.4, accepts a user_roles value at checkout without checking it against the allowed roles. An unauthenticated visitor can create an account with the administrator role and take over the whole site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","registration-form-for-woocommerce"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated visitor becomes site Administrator; full site takeover","analyst_note":"Find the first fixed plugin version after 1.1.4 in the WordPress plugin changelog or the NVD references, since no source names one.","how_to_check":"- Check the installed version of the Registration Form for WooCommerce plugin; versions up to and including `1.1.4` are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Registration Form for WooCommerce plugin at or below version 1.1.4 with WooCommerce checkout account creation are exposed. The flaw sits in the checkout registration path, so a store that does not run this plugin or has upgraded past 1.1.4 can skip it. The sources do not say whether checkout registration must be enabled for the flaw to be reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00123,"input_tokens":4427,"output_tokens":1575,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the first fixed plugin version after 1.1.4 in the WordPress plugin changelog or the NVD references, since no source names one.","search":"'-119075':13A,16A '-2026':12A,15A '1.1.4':42B,108C 'accept':43B 'account':63B,111C,175C,201C 'add':160C 'administr':10A,66B,190C,196C 'allow':55B,92C,126C,156C 'allow-list':91C,155C 'attack':184C 'becom':9A 'check':51B,94C 'checkout':6A,49B,99C,130C,134C,140C,203C 'configur':125C 'creat':61B,199C 'custom':170C 'cve':11A,14A 'data':152C,162C,171C 'due':87C 'elev':186C 'enforc':158C 'escal':86C 'field':100C,115C,135C 'for':20A 'form':2A,19A,25B,32B,76C,123C 'formhandl':97C 'full':206C 'function':101C 'hook':136C 'includ':40B,107C 'inject':164C 'list':93C,157C 'make':179C 'miss':90C 'new':169C,174C 'packag':22B 'paramet':197C 'path':113C,132C 'plugin':36B,79C 'possibl':181C 'post':145C 'privileg':85C,188C 'raw':144C 'registr':1A,24B,31B,75C,112C,131C 'registration':18A 'registration-form-for-woocommerc':23B 'registration-form-for-woocommerce':17A 'result':204C 'role':46B,56B,67B,127C,147C,177C,195C 'site':73B,207C 'store':142C 'submit':118C 'suppli':192C 'take':69B 'takeov':208C 'tgwcfb/user-roles':119C 'unauthent':5A,58B,183C 'user':7A,45B,146C,161C,194C 'valid':98C,114C,116C,133C,141C,151C 'valu':47B,120C,148C,166C 'version':41B,103C 'visitor':59B 'vulner':83C 'whole':72B 'without':50B,153C 'woocommerc':4A,27B,28B,34B,78C,138C,168C 'woocommerce':21A 'wordpress':29B,35B,81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Registration Form for WooCommerce plugin at or below version 1.1.4 with WooCommerce checkout account creation are exposed. The flaw sits in the checkout registration path, so a store that does not run this plugin or has upgraded past 1.1.4 can skip it. The sources do not say whether checkout registration must be enabled for the flaw to be reachable.","tier":"B","verified":{"fix":{"at":"2026-11-07T12:50:01Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout","run_id":2107},"products":{"at":"2026-11-07T12:50:01Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout","run_id":2107},"how_to_check":{"at":"2026-11-07T12:50:01Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout","run_id":2107}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["registrationformforwoocommerce"],"ptokens":["for","form","registration","woocommerce"],"labels":["critical","package","registrationformforwoocommerce","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-119075':13A,16A '-2026':12A,15A 'administr':10A 'becom':9A 'checkout':6A 'cve':11A,14A 'for':20A 'form':2A,19A 'registr':1A 'registration':18A 'registration-form-for-woocommerce':17A 'unauthent':5A 'user':7A 'woocommerc':4A 'woocommerce':21A","search_b":"'1.1.4':42B 'accept':43B 'account':63B 'administr':66B 'allow':55B 'check':51B 'checkout':49B 'creat':61B 'form':25B,32B 'includ':40B 'packag':22B 'plugin':36B 'registr':24B,31B 'registration-form-for-woocommerc':23B 'role':46B,56B,67B 'site':73B 'take':69B 'unauthent':58B 'user':45B 'valu':47B 'version':41B 'visitor':59B 'whole':72B 'without':50B 'woocommerc':27B,28B,34B 'wordpress':29B,35B","search_c":"'1.1.4':108C 'account':111C,175C,201C 'add':160C 'administr':190C,196C 'allow':92C,126C,156C 'allow-list':91C,155C 'attack':184C 'check':94C 'checkout':99C,130C,134C,140C,203C 'configur':125C 'creat':199C 'custom':170C 'data':152C,162C,171C 'due':87C 'elev':186C 'enforc':158C 'escal':86C 'field':100C,115C,135C 'form':76C,123C 'formhandl':97C 'full':206C 'function':101C 'hook':136C 'includ':107C 'inject':164C 'list':93C,157C 'make':179C 'miss':90C 'new':169C,174C 'paramet':197C 'path':113C,132C 'plugin':79C 'possibl':181C 'post':145C 'privileg':85C,188C 'raw':144C 'registr':75C,112C,131C 'result':204C 'role':127C,147C,177C,195C 'site':207C 'store':142C 'submit':118C 'suppli':192C 'takeov':208C 'tgwcfb/user-roles':119C 'unauthent':183C 'user':146C,161C,194C 'valid':98C,114C,116C,133C,141C,151C 'valu':120C,148C,166C 'version':103C 'vulner':83C 'without':153C 'woocommerc':78C,138C,168C 'wordpress':81C","first_public_at":"2026-11-07T12:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119075","severity":null,"published_at":"2026-11-07T12:17:44+00:00","modified_at":"2026-11-07T12:17:44+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119075:2107","url":"https://wordpress.org/plugins/registration-form-for-woocommerce/","severity":null,"published_at":"2026-11-07T12:50:01+00:00","modified_at":"2026-11-07T12:50:01+00:00","first_seen_at":"2026-11-07T12:50:01+00:00","fetched_at":"2026-11-07T12:50:01+00:00","note":"Fixed in 1.1.5 (06-11-2026) per ThemeGrill's wordpress.org changelog: 'Prevented privilege escalation via the user role submitted at checkout.' Wordfence advisory confirms <=1.1.4, CVSS 9.8, researcher JB Sabit. No exploitation or PoC seen. Unverified whether checkout registration must be enabled; who_affected left as is.","cites":["https://wordpress.org/plugins/registration-form-for-woocommerce/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout"]}],"documents":[{"id":95545,"url":"https://wordpress.org/plugins/registration-form-for-woocommerce/","title":"Registration Form for WooCommerce – changelog 1.1.5 (ThemeGrill, wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":95546,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout","title":"Wordfence: Registration Form for WooCommerce <= 1.1.4 privilege escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}