What is the CVSS score of CVE-2025-60211?

CVE-2025-60211 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WooCommerce Registration Fields are affected by CVE-2025-60211?

The extendons WooCommerce Registration Fields Plugin (slug extendons-registration-fields) versions up to and including 3.2.3 can allow a low-privilege store account to gain administrator control of…

How to fix or mitigate CVE-2025-60211?

Within 24 hours, inventory all WordPress/WooCommerce sites using the extendons-registration-fields plugin and confirm whether any are at versions up to and including 3.2.3; if the plugin is not business-critical, deactivate and delete it, and if it must remain, immediately disable open WooCommerce customer registration or restrict new account creation to trusted/invite-only workflows, and audit administrator accounts for unauthorized additions. Within 7 days, implement virtual patching or WAF rules to protect the plugin's registration and signup endpoints, review user and registration logs for suspicious role changes, rotate administrator credentials, enforce MFA for privileged accounts, and remove unnecessary administrator privileges. Within 30 days, replace the vulnerable plugin with a maintained alternative or apply the vendor patch as soon as it is released, and continue monitoring vendor advisories and site user roles until remediation is complete; because no vendor-released patch identified at time of analysis, do not rely on the plugin remaining secure without these controls.

WooCommerce Registration Fields CVE-2025-60211

HIGH

Incorrect Privilege Assignment (CWE-266)

2025-10-22 audit@patchstack.com

WordPress Privilege Escalation Woocommerce Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable privilege escalation needing a low-privilege account (PR:L), no interaction (UI:N); escalation to admin yields full C/I/A on the same system (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 12:27 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Privilege Escalation.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.

AnalysisAI

Privilege escalation in the extendons WooCommerce Registration Fields Plugin - Custom Signup Fields (slug extendons-registration-fields) at versions up to and including 3.2.3 allows an authenticated low-privilege user - for example a self-registered WooCommerce customer or subscriber, which is trivial to obtain on stores with open registration - to escalate their account to administrator over the network with no user interaction. The defect is an incorrect privilege assignment (CWE-266) in the plugin's custom signup/registration field handling, and because the resulting administrator role grants full content, configuration and user control, confidentiality, integrity and availability impacts are all rated high. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.39% (31st percentile), so this is a credible, actionable priority rather than an inflated CVSS score, contingent on the plugin being installed and active and on the attacker being able to register an account.

Technical ContextAI

The root cause class is CWE-266, Incorrect Privilege Assignment - the plugin mishandles the role or capability value applied to a user during the custom registration/signup field workflow, so a submission that should produce a default low-privilege account instead yields one with elevated WordPress capabilities. In WordPress, roles and capabilities are stored in user metadata and drive every authorization decision in core and in WooCommerce; a role-assignment bug therefore bypasses the normal privilege boundary entirely rather than exploiting a memory-safety or injection flaw. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack is network-reachable, low complexity, requires only a privileged-but-low account (PR:L, i.e. any registered user), needs no victim interaction, and does not change scope because the attacker stays within the same WordPress/plugin trust boundary while gaining administrator rights. No CPE identifiers or vendor advisory details beyond the Patchstack entry were supplied, and the affected component is a third-party WooCommerce extension layered on top of WordPress and WooCommerce, so exposure depends on the plugin being installed, active and reachable through its registration endpoint.

Affected ProductsAI

The affected product is the WordPress plugin 'WooCommerce Registration Fields Plugin - Custom Signup Fields' by extendons, distributed under the slug extendons-registration-fields; all versions from n/a through 3.2.3, including 3.2.3 itself, are vulnerable. The site must also be running WordPress with WooCommerce and the plugin must be active, with its custom signup/registration fields exposed, for the privilege-escalation path to be reachable. No CPE strings were provided with this record, so identification should be done by plugin slug and installed version rather than by CPE matching. The only reference supplied is the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/extendons-registration-fields/vulnerability/wordpress-woocommerce-registration-fields-plugin-custom-signup-fields-plugin-3-2-3-privilege-escalation-vulnerability?_s_id=cve, which should be treated as the authoritative vendor-side tracking page.

RemediationAI

No vendor-released patch or exact fixed version is identified in the provided data - the record only states affected versions up to and including 3.2.3 - so the first step is to check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/extendons-registration-fields/vulnerability/wordpress-woocommerce-registration-fields-plugin-custom-signup-fields-plugin-3-2-3-privilege-escalation-vulnerability?_s_id=cve) and the plugin's WordPress.org/agency release channel for a version newer than 3.2.3 and apply it as soon as it appears. Until then, the highest-value compensating control is to disable public/open registration and any guest checkout paths that create accounts, which removes the low-privilege foothold the attack requires; the trade-off is lost self-service signups and potential checkout friction. If the plugin's custom signup fields are not essential, deactivate and remove extendons-registration-fields entirely - the custom registration fields will stop rendering and any stored field data will be orphaned, but the vulnerable code path disappears. Additionally, restrict registration to administrator-approved accounts, audit existing users for unexpected administrator roles (a strong indicator of prior exploitation), review WooCommerce and WordPress user-role change logs, and, where a WAF is available, virtual-patch requests to the plugin's registration endpoints. General WordPress hardening - keeping core, WooCommerce and all extensions current and enforcing least privilege on roles - reduces the window of exposure but does not by itself fix the incorrect privilege assignment.