A critical privilege escalation flaw (CVSS 9.8) in the ThemeGrill Registration Form for WooCommerce plugin for WordPress lets unauthenticated attackers create Administrator accounts during checkout.
What Is It
The plugin checks submitted user roles on one registration path but not on the other. On the My Account path, validate_fields() checks a submitted tgwcfb/user-roles value against the form's configured allowed roles. The checkout path, FormHandler::validate_checkout_fields(), is hooked to woocommerce_after_checkout_validation. It stores the raw $_POST['user_roles'] value in $this->valid_data with no allow-list check.
add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. An attacker who creates an account at checkout and supplies user_roles=administrator gets an Administrator account.
The weakness is classified as CWE-269 (Improper Privilege Management). Wordfence reported it, and the CVE was published on 2026-11-07.
Why It Matters
NVD rates this 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H):
- It is exploitable over the network with low attack complexity.
- It needs no privileges and no user interaction.
- Confidentiality, integrity and availability impact are all high.
The NVD description says successful exploitation results in "full site takeover." Any public storefront that uses this plugin with checkout registration enabled is exposed to anonymous attackers.
As of 2026-11-07, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so CISA has not confirmed active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: ThemeGrill
- Product: Registration Form for WooCommerce (WordPress plugin)
- Affected versions: all versions up to and including 1.1.4
The NVD record lists no affected CPEs.
Patch Status
The supplied data lists versions through 1.1.4 as affected. NVD references a WordPress plugin repository changeset between tags 1.1.4 and 1.1.5, which points to a code change in version 1.1.5. The source material does not explicitly say that 1.1.5 is the fixed release. Administrators should:
- Move off any version at or below 1.1.4.
- Confirm the fixed version in the Wordfence advisory.
- Check existing user accounts for Administrator accounts they did not create, since attackers may have registered them before the update.
There is no CISA KEV required action or due date, because the CVE is not listed in the CISA KEV catalog.