CVEvulnerability

CVE-2026-13152

8.1 HIGH Published 2026-07-27 Modified 2026-07-27 Official page ↗
Status
Deferred
Published
2026-07-27
Last modified
2026-07-27
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269

Description

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References