CVE-2026-119075

Summary

The Registration Form for WooCommerce plugin (≤1.1.4) lacks role validation in the checkout registration path, allowing unauthenticated attackers to inject arbitrary user roles via POST data during checkout. This bypasses the allow-list check used in the My Account registration flow and enables privilege escalation to Administrator.

Exploitability

Exploitation is trivial for unauthenticated attackers with no prerequisites beyond access to the WooCommerce checkout page; it requires only sending a single HTTP POST request with user_roles=administrator.

Blast radius

Successful exploitation grants full administrative control of the WordPress site, enabling complete data exfiltration, malware deployment, or site defacement.

Detection

Defenders should monitor WooCommerce checkout POST requests for unexpected 'user_roles' parameters containing privileged roles (e.g., administrator, editor); such requests are anomalous since legitimate checkout flows do not submit user role data. Log entries showing new user creation with non-default roles via checkout-triggered events may also indicate exploitation.

Prioritized remediation

Upgrade to Registration Form for WooCommerce version 1.1.5 or later, which enforces role allow-listing in the checkout registration path.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.