CVE-2026-119075
Deferred Deferred - Pending Action

Privilege Escalation in WooCommerce Registration Form Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-119075
EUVD
EUVD-2026-119150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themegrill Registration Form for WooCommerce From 0 (inc) to 1.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the Registration Form for WooCommerce plugin for WordPress. It allows unauthenticated attackers to gain Administrator privileges by submitting a specific parameter during checkout registration. The issue occurs because the plugin fails to validate the 'user_roles' value properly when creating an account during checkout, unlike the My Account registration path which has proper allow-list checks.

Detection Guidance

Check WordPress sites using the Registration Form for WooCommerce plugin versions up to 1.1.4. Look for unauthorized administrator role assignments in user logs. Inspect checkout registration forms for unexpected user_roles parameter submissions.

Impact Analysis

This vulnerability can lead to a full site takeover. Attackers can exploit it to create an account with Administrator privileges without authentication. Once compromised, attackers gain complete control over the WordPress site, including the ability to modify content, install malicious plugins, steal data, or disrupt operations.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. A site takeover could lead to data breaches, unauthorized data access, or modification, violating privacy and security requirements. Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Registration Form for WooCommerce plugin to the latest version. Disable checkout registration if not needed. Implement input validation to restrict user_roles parameter values. Monitor for suspicious administrator account creations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...