Is CVE-2026-54807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54807 being exploited in the wild.

How severe is CVE-2026-54807?

Critical severity, with a CVSS score of 9.8, published 17 June 2026.

Which products and versions are affected?

ThemeGrill Registration Form for WooCommerce <= 1.0.9.

Is there a fix for CVE-2026-54807?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54807 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54807?

Check whether you run ThemeGrill Registration Form for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54807: ThemeGrill Registration Form for WooCommerce privilege escalation

Q: Is there a fix for CVE-2026-54807?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-54807 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54807?

Check whether you run ThemeGrill Registration Form for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54807 · Severity: critical · CVSS 9.8 · Published 2026-06-17

A vulnerability in the Registration Form for WooCommerce plugin for WordPress allows unauthorized users to gain administrative control over a website. This plugin is used to customize user registration for online stores. An attacker could exploit this flaw to take over the site, potentially leading to the theft of customer data, service disruption, or complete site defacement.

Vendors: ThemeGrill.

Quick answers

Is CVE-2026-54807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54807 being exploited in the wild.
How severe is CVE-2026-54807?: Critical severity, with a CVSS score of 9.8, published 17 June 2026.
Which products and versions are affected?: ThemeGrill Registration Form for WooCommerce <= 1.0.9.
Is there a fix for CVE-2026-54807?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54807 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54807?: Check whether you run ThemeGrill Registration Form for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Registration Form for WooCommerce plugin for WordPress (versions <= 1.0.9) is vulnerable to unauthenticated privilege escalation due to incorrect privilege assignment (CWE-266) within its registration handling logic. A remote, unauthenticated attacker can exploit this flaw to register an account with elevated privileges, such as Administrator, without any prior authentication or user interaction. This allows for a complete compromise of the WordPress instance. The issue is resolved in version 1.1.0.

Affected products

ThemeGrill Registration Form for WooCommerce <= 1.0.9

Timeline

2026-05-27: other: Reported by ParkHyunWoo
2026-06-16: advisory: Patchstack advisory published
2026-06-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.