CVE-2026-81431: Registration Form for WooCommerce privilege escalation via unvalidated form reference

CVE-2026-81431 · Severity: high · CVSS 7.2 · Published 2026-09-10

Registration Form for WooCommerce is a WordPress plugin that manages user registration forms for WooCommerce sites. A privilege escalation vulnerability allows users with basic posting permissions (Contributor role and above) to register new administrator accounts, resulting in complete compromise of the WordPress site. The flaw stems from inadequate validation of which forms are legitimate registration forms during signup.

Vendors: ThemeGrill.

Quick answers

Is CVE-2026-81431 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81431 being exploited in the wild.
How severe is CVE-2026-81431?
High severity, with a CVSS score of 7.2, published 10 September 2026.
Which products and versions are affected?
ThemeGrill Registration Form for WooCommerce 1.1.0 through 1.1.2.
Is there a fix for CVE-2026-81431?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81431 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81431?
Check whether you run ThemeGrill Registration Form for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to validate that the form referenced during registration is a legitimate registration form, instead reading the permitted-role allow-list from an arbitrary attacker-controlled post identified by the tgwcfb_id parameter. An attacker with Contributor or higher privileges can create a malicious post, craft a registration request pointing to it via an unvalidated tgwcfb_id, and register a new account with any role including Administrator. This represents an incomplete fix of the earlier CVE-2026-54807. The vulnerability requires authenticated access (Contributor role minimum) and allows unauthenticated user registration with elevated privileges. A patch is available in version 1.1.3.

Affected products

  • ThemeGrill Registration Form for WooCommerce 1.1.0 through 1.1.2

Timeline

  • 2026-09-08: disclosed
  • 2026-09-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.