CVE-2026-13152
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
- State
- Published
- Severity
- 8.1 High
- Published
- Jul 27, 2026
- Updated
- Jul 27, 2026
- Reserved
- Jun 24, 2026
Description
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
Custom Fields Account Registration For WoocommerceUnknown |
|
References
- https://wpscan.com/vulnerability/36aaba38-3143-4e80-8386-748632ff6704/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.