CVE-2026-119075 in Registration Form for WooCommerce Plugin
Summary
by MITRE • 11/07/2026
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The Registration Form for WooCommerce plugin contains a critical privilege escalation vulnerability affecting versions up to and including 1.1.4. This flaw stems from an inconsistent implementation of input validation across different registration pathways within the application logic. Specifically, while the My Account registration path correctly validates submitted user role values against a configured allow-list, the checkout registration path fails to perform this essential security check. The vulnerability resides in the FormHandler::validate_checkout_fields() function, which is hooked into woocommerce_after_checkout_validation. This discrepancy creates an exploitable gap that allows unauthenticated attackers to bypass intended access controls and escalate their privileges on the WordPress site.
The technical root cause of this issue lies in how user role data is processed during account creation via the WooCommerce checkout process. In a secure implementation, any input determining administrative or elevated permissions must be strictly validated against an allow-list of permitted roles defined by the administrator. However, in the affected versions, the validate_checkout_fields() function stores the raw $_POST['user_roles'] value directly into $this->valid_data without performing any allow-list enforcement. Subsequently, when the add_user_data() function executes, it injects this unvalidated data into woocommerce_new_customer_data as the role for the newly created account. This lack of sanitization means that if an attacker submits a request with user_roles set to administrator during checkout, the system will accept and apply this value without question.
The operational impact of this vulnerability is severe, leading directly to full site takeover by unauthenticated attackers. By exploiting this flaw, an attacker can create a new account with Administrator privileges simply by modifying the registration form submission parameters. Once these elevated credentials are established, the attacker gains complete control over the WordPress installation. This includes the ability to modify core files, install malicious plugins or themes, access sensitive database information, and potentially compromise other users' data stored within the platform. The ease of exploitation makes this a high-risk vulnerability that can be leveraged by automated scanning tools or attackers with minimal technical expertise.
From an industry standards perspective, this vulnerability aligns with CWE-269: Improper Privilege Management, as it involves failing to enforce proper authorization checks for administrative functions. It also relates to CWE-798: Use of Hard-coded Credentials if the attacker leverages default or easily guessable credentials alongside the role escalation, though the primary issue is the lack of input validation leading to privilege elevation. In terms of MITRE ATT&CK mapping, this exploit corresponds to T1078: Valid Accounts and specifically T1068: Exploitation for Privilege Escalation, where an attacker leverages a software vulnerability to gain higher-level permissions than originally intended by the system design.
To mitigate this risk, immediate action is required from site administrators using affected versions of the plugin. The primary remediation step is to update the Registration Form for WooCommerce plugin to version 1.1.5 or later, where the missing allow-list check in validate_checkout_fields() has been implemented. Until an update can be applied, temporary mitigations include restricting access to the checkout endpoint if possible, although this may impact legitimate user experience. Additionally, implementing a Web Application Firewall with rules that detect and block attempts to inject role parameters during registration requests can provide a layer of defense against exploitation. Regular security audits focusing on input validation consistency across all entry points are recommended to prevent similar discrepancies in future development cycles.