https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 13:42:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119075 <p>The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted &#39;tgwcfb/user-roles&#39; value against the form&#39;s configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST[&#39;user_roles&#39;] value in $this-&gt;valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account&#39;s role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.</p> <p>The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted &#39;tgwcfb/user-roles&#39; value against the form&#39;s configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST[&#39;user_roles&#39;] value in $this-&gt;valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account&#39;s role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119075 https://db.gcve.eu/vuln/ghsa-f92p-rvh5-3x75 <p>The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted &#39;tgwcfb/user-roles&#39; value against the form&#39;s configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST[&#39;user_roles&#39;] value in $this-&gt;valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account&#39;s role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.</p> <p>The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted &#39;tgwcfb/user-roles&#39; value against the form&#39;s configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST[&#39;user_roles&#39;] value in $this-&gt;valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account&#39;s role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.</p> https://db.gcve.eu/vuln/ghsa-f92p-rvh5-3x75