Executive brief
Registration Form for WooCommerce is a WordPress plugin that manages user registration forms for WooCommerce sites. A privilege escalation vulnerability allows users with basic posting permissions (Contributor role and above) to register new administrator accounts, resulting in complete compromise of the WordPress site. The flaw stems from inadequate validation of which forms are legitimate registration forms during signup.
Technical details
The plugin fails to validate that the form referenced during registration is a legitimate registration form, instead reading the permitted-role allow-list from an arbitrary attacker-controlled post identified by the tgwcfb_id parameter. An attacker with Contributor or higher privileges can create a malicious post, craft a registration request pointing to it via an unvalidated tgwcfb_id, and register a new account with any role including Administrator. This represents an incomplete fix of the earlier CVE-2026-54807. The vulnerability requires authenticated access (Contributor role minimum) and allows unauthenticated user registration with elevated privileges. A patch is available in version 1.1.3.
Affected products
- ThemeGrill Registration Form for WooCommerce 1.1.0 through 1.1.2
Timeline
- 2026-09-08: disclosed
- 2026-09-10: advisory