AI analysis
Claude Opus · 9 Nov 2026, 10:20 CET
Registration Form for WooCommerce flaw lets anonymous shoppers become site administrators
Registration Form for WooCommerce for WordPress, versions up to and including 1.1.4, lets unauthenticated visitors create Administrator accounts during checkout. Update beyond 1.1.4 or disable the plugin, then audit recently created administrator accounts.
In plain terms
Registration Form for WooCommerce is a WordPress plugin that adds custom sign-up forms to online shops built on WooCommerce. When a shopper creates an account, the site should decide what kind of account they get, normally an ordinary customer. In versions up to and including 1.1.4, the account-creation step at checkout trusts a value sent by the visitor's browser to decide the account's role, which is the set of permissions the account has.
This means anyone on the internet, without logging in, could give themselves a full Administrator account while placing an order. An administrator controls the entire WordPress site, so this amounts to a full site takeover. Anyone running a WooCommerce shop with this plugin should treat it as urgent.