WooCommerce Custom Fields PRIVESC via Unauthenticated User Registration (CVE-2026-13152)

Vulnerability Overview Vulnerability Name: Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation Description: The plugin fails to prevent the writing of user capability meta keys by its custom registration fields on sites using a non-default database table prefix. Consequently, when fields with specific names are configured, unauthenticated users can be granted administrator privileges during account registration. CVE Number: CVE-2026-13152 Classification: - Type: PRIVESC - OWASP Top 10: A2: Broken Authentication and Session Management - CWE: CWE-269 - CVSS: 8.1 (high) Affected Scope Affected Plugin: custom-fields-account-registration-for-woocommerce Fixed Version: 1.4 Remediation Fixed Version: Upgrade to version 1.4 or later. Timeline Public Disclosure Date: 2026-07-06 Add Date: 2026-07-06 Last Updated Date: 2026-07-24 Additional Information Original Researcher: Huynh Kien Minh Submitter: Huynh Kien Minh Verification Status: Yes WPVDB ID: 36aaba38-3143-4e80-8386-748632ff6704 Related Vulnerabilities FindAll Listing < 1.1 - Unauthenticated Privilege Escalation (2025-11-26) WP Security Audit Log < 4.0.2 - Broken Access Control in First-Time Install Wizard (2020-03-06) Woffice < 5.4.22 - Authentication Bypass via Registration Role (2025-04-03) JetFormBuilder — Dynamic Blocks Form Builder < 3.6.1.1 - Subscriber+ Privilege Escalation (2026-06-16) WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation (2020-06-11) POC Code Specific POC code is not provided in the page, but it is noted that the POC will be revealed on 2026-08-06 to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Custom Fields PRIVESC via Unauthenticated User Registration (CVE-2026-13152)

More from this source