WordPress Plugin Vulnerabilities

Registration Form for WooCommerce < 1.1.0 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, allowing unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
registration-form-for-woocommerce
Fixed in 1.1.0

References

CVE
CVE-2026-54807
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a13c364f-bf86-41a9-b56e-949af38c01c6

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
ParkHyunWoo
Verified
No
WPVDB ID
885ee846-a6bf-4265-9c48-2c87798425e8

Timeline

Publicly Published
2026-06-16 (about 26 days ago)
Added
2026-06-25 (about 16 days ago)
Last Updated
2026-07-10 (about 1 day ago)

Other

Published
Title
Published
2026-05-01
Title
Import and export users and customers < 2.0.9 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
Published
2026-06-29
Title
Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
Published
2026-05-22
Title
WishList Member < 3.31.0 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action
Published
2025-02-11
Title
WP Job Board Pro < 1.2.82 - Unauthenticated Privilege Escalation
Published
2024-11-27
Title
WP JobSearch < 2.6.8 - Unauthenticated Privilege Escalation