Executive brief
A vulnerability in a WooCommerce registration plugin allows unauthorized users to grant themselves administrative access to a website. By exploiting a flaw in how custom registration fields are handled, an attacker can manipulate their account permissions during the sign-up process. This could lead to a total takeover of the website, exposing customer data and disrupting business operations.
Technical details
The vulnerability is an unauthenticated privilege escalation flaw occurring during the account registration process. The plugin fails to restrict custom registration fields from writing to the user capabilities meta key, specifically on WordPress installations using a non-default database table prefix. If a custom field is configured with a name matching the capabilities meta key, a remote, unauthenticated attacker can provide malicious input during registration to assign themselves the 'administrator' role. This issue is resolved in version 1.4.
Affected products
- Unknown Custom Fields Account Registration For Woocommerce < 1.4
Timeline
- 2026-07-06: disclosed: Publicly published on WPScan
- 2026-07-27: advisory: NVD published date
- 2026-07-27: patched: Fixed in version 1.4