WordPress Plugin Vulnerabilities

Registration Form for WooCommerce < 1.1.0 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, allowing unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
registration-form-for-woocommerce
Fixed in 1.1.0

References

CVE
CVE-2026-54807
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a13c364f-bf86-41a9-b56e-949af38c01c6

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
ParkHyunWoo
Verified
No
WPVDB ID
885ee846-a6bf-4265-9c48-2c87798425e8

Timeline

Publicly Published
2026-06-16 (about 2 months ago)
Added
2026-06-25 (about 2 months ago)
Last Updated
2026-08-25 (about 21 hours ago)

Other

Published
Title
Published
2023-11-07
Title
Ovic Responsive WPBakery < 1.2.9 - Subscriber+ Option Update
Published
2024-07-10
Title
InstaWP Connect – 1-click WP Staging & Migration < 0.1.0.45 - Authentication Bypass to Admin
Published
2025-03-31
Title
WP RealEstate < 1.6.27 - Unauthenticated Privilege Escalation via 'process_register'
Published
2023-04-05
Title
WCFM Membership < 2.10.1 - Unauthenticated Privilege Escalation
Published
2026-03-02
Title
LMS Elementor Pro <= 1.0.4 - Unauthenticated Privilege Escalation