Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Registration Form For Woocommerce - Security Vulnerability (CVE-2026-119075)
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their…
PLUGIN
Registration Form For Woocommerce
CVE-2026-119075
Risk Score
Threat Entry
Updated 2026-09-10
Registration Form for WooCommerce - Improper Input Validation (CVE-2026-81431)
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
PLUGIN
Registration Form for WooCommerce
CVE-2026-81431
Risk Score
Threat Entry
Updated 2026-06-17
Registration Form for WooCommerce - Privilege Escalation (CVE-2026-54807)
Unauthenticated Privilege Escalation in Registration Form for WooCommerce
PLUGIN
Registration Form for WooCommerce
CVE-2026-54807
Risk Score