CVE-2026-119075: Admin Escalation in WooCommerce Plugin

CVE-2026-119075 affects the Registration Form for WooCommerce plugin for WordPress up to version 1.1.4. A privilege escalation flaw allows unauthenticated users to elevate their privileges to Administrator during checkout registration by supplying the user_roles=administrator parameter without validation. The outcome is full administrative access to the site.

The vulnerability carries a CVSS score of 9.8 (critical). The flaw resides in the checkout registration path (validate_checkout_fields() function), which lacks the allow-list enforcement present in the My Account path (validate_fields()). The code directly reads the raw $_POST['user_roles'] value and injects it into woocommerce_new_customer_data without filtering. It has been reported simultaneously on X by industry sources.

Administrators must update the Registration Form for WooCommerce plugin to the patched version as soon as available. In the interim, disable the checkout registration form or deploy a Web Application Firewall to block POST requests containing the user_roles parameter on checkout paths. Monitor access logs for recently created accounts with unexpected Administrator roles.

WooCommerce is one of the most widely deployed e-commerce platforms on WordPress. The Registration Form plugin expands exposure by enabling quick checkout registration, making the vulnerability potentially exploitable across thousands of unpatched online stores.