Privilege Escalation in Custom Fields Account Registration for Woocommerce by WordPress
CVE-2026-13152
What is CVE-2026-13152?
The Custom Fields Account Registration for Woocommerce plugin prior to version 1.4 contains a vulnerability that permits an unauthenticated user to exploit custom registration fields. By setting up a corresponding field name that maps to the user capabilities meta key, an attacker can grant themselves administrative privileges on WordPress sites that utilize a non-default database table prefix. This flaw highlights the importance of stringent access controls and the need for proper validation of user inputs during the registration process.
Affected Version(s)
Custom Fields Account Registration For Woocommerce 0 < 1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.