WooCommerce registration fields can grant administrator capabilities
Custom Fields Account Registration For Woocommerce before 1.4 can write registration input into user-capability metadata when WordPress uses a non-default database table prefix. If an administrator has configured a correspondingly named registration field, an unauthenticated registrant can submit capability data that grants the new account administrator privileges. The CNA record does not disclose the field name, registration action, parameter or metadata-writing function.
- Component
- Custom Fields Account Registration For Woocommerce
- Affected
- < 1.4
- Safe version
1.4- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update Custom Fields Account Registration For Woocommerce to 1.4 or later. Review recently registered users and their capability metadata, remove unauthorized administrators and rotate WordPress salts if privilege escalation may have occurred.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H