Privilege Escalation Vulnerability in WooCommerce Registration Form Plugin by WordPress

CVE-2026-119075

What is CVE-2026-119075?

The WooCommerce Registration Form plugin for WordPress has a vulnerability that allows unauthenticated attackers to escalate privileges. Due to a missing allow-list check in the validation process of checkout fields, an attacker can submit malicious input during account creation. Specifically, by injecting a 'user_roles=administrator' parameter, attackers can bypass the intended role validation, effectively granting themselves administrator access. This critical issue can lead to a complete site takeover, compromising the security and functionality of the affected WordPress site.

References