CVE-2026-119075

Description

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: CRITICAL
CVSS score: 9.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Effective score: 9.8 / 10 CRITICAL source: CNA overview
CWE(s): CWE-269
Reserved: 2026-10-29
Published: 2026-11-07 11:26 UTC
Last updated: 2026-11-07 18:26 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119075.json
Linked Threat: CVE-2026-119075 — Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

Affected products (1)

Vendor	Product	Versions	Platforms
themegrill	Registration Form for WooCommerce	`0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

MITRE references (4) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-119075`	no local data	2026-11-07 00:25 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

PHP2Shell: Hidden PHP exposure and WAF mitigation

web:blog.barracuda.com

Find PHP exposure in applications and appliances, prioritize patches, and understand how WAF controls can reduce risk without replacing PHP updates.

2026-11-07 00:25 UTC
Cisco Advance Notification for Publication of November 4, 2026 ...

web:sec.cloudapps.cisco.com

On November 4, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco UCS Central Software Remote Code Execution Vulnerability CVE - 2026 -76506 High 7.6 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability CVE - 2026 -76419 Medium 6.1 Cisco Identity Services ...

2026-11-07 00:25 UTC
Pre-Authentication Authorization Bypass and Command Injection ...

web:trust.barracuda.com

Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied.

2026-11-07 00:25 UTC
PHP Releases Emergency Patches for Two Critical Flaws That Let ...

web:www.defconlevel.com

CYBER - The PHP project shipped emergency updates on October 21, 2026 , that fix two critical security flaws. These flaws can let an attacker run code on a web server that uses PHP, without needing a login or any credentials.

2026-11-07 00:25 UTC
CISA Confirms Exploitation of WordPress Core Upgrade Flaw

web:www.esecurityplanet.com

CISA confirms exploitation of a WordPress Core upgrade flaw. Learn which versions contain fixes and what administrators should check for signs of compromise.

2026-11-07 00:25 UTC
Critical PHP Security Warning Issued—Apply Emergency Patch Today - Forbes

web:www.forbes.com

Millions of website admins are being urged to patch their PHP installs today as more than half of all sites could be vulnerable to critical new security flaws.

2026-11-07 00:25 UTC
NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

web:www.nsa.gov

PHP released their open-source software patch Wednesday, October 21, 2026 . Additional software vendors may also publish patches once they are available. It's imperative to closely monitor these updates. Information on the latest mitigations and patching guidance is available on the PHP.net Security Advisory page.

2026-11-07 00:25 UTC
CISA confirms WordPress security flaw under attack: What website owners ...

web:www.pcquest.com

CISA confirms attacks on a WordPress Core flaw that could expose servers during updates. Learn which versions are affected and what administrators should check.

2026-11-07 00:25 UTC
Wordfence remediation: Registration Form for WooCommerce

Wordfence

Update to version 1.1.5, or a newer patched version

2026-11-07 00:25 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-119075.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:49.846770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:31.030Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Registration Form for WooCommerce",
          "vendor": "themegrill",
          "versions": [
            {
              "lessThanOrEqual": "1.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JB Sabit"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:30.206Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/714d10b0-526c-4347-a369-85fc32ef3478?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L354"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/registration-form-for-woocommerce/tags/1.1.3/includes/FormHandler.php#L407"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.4&new_path=%2Fregistration-form-for-woocommerce%2Ftags%2F1.1.5"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-06T04:58:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:45:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-119075",
    "datePublished": "2026-11-07T11:26:30.206Z",
    "dateReserved": "2026-10-29T13:06:26.068Z",
    "dateUpdated": "2026-11-07T18:26:31.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}