What is the CVSS score of CVE-2026-54807?

CVE-2026-54807 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Registration Form for WooCommerce are affected by CVE-2026-54807?

The ThemeGrill Registration Form plugin for WooCommerce contains a critical unauthenticated privilege escalation vulnerability (CVE-2026-54807, CVSS 9.8) allowing remote attackers to gain full…

How to fix or mitigate CVE-2026-54807?

Within 24 hours: Inventory all WordPress instances using ThemeGrill Registration Form plugin versions 1.0.9 or earlier; immediately deactivate and uninstall the plugin; restrict administrative panel access via IP allowlisting pending remediation. Within 7 days: Monitor Patchstack advisory and vendor channels for patch availability; identify alternative registration form solutions; implement Web Application Firewall rules if plugin re-enablement is unavoidable. Within 30 days: Deploy vendor patch immediately upon release (exact version pending advisory); test in staging environment; audit WordPress user privilege levels for unauthorized modifications; restore functionality only after security validation.

Registration Form for WooCommerce CVE-2026-54807

EUVD-2026-37643 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-06-17 Patchstack

WordPress Privilege Escalation Wordpress Plugin Registration Form For Woocommerce Themegrill

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable WordPress registration endpoint, no auth or interaction, and role-assignment flaw yields full admin takeover - full C/I/A impact at PR:N/UI:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:51 vuln.today

CVE Published

Jun 17, 2026 - 09:51 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress ThemeGrill Registration Form Plugin - CVE-2026-54807 Jun 17, 2026

AnalysisAI

Unauthenticated privilege escalation in the ThemeGrill Registration Form for WooCommerce WordPress plugin (versions <= 1.0.9) allows remote attackers to elevate privileges without credentials, potentially gaining administrative control over the WordPress site. With a CVSS of 9.8 and no public exploit identified at time of analysis, the flaw is reported by Patchstack and tagged as a Privilege Escalation issue in the WordPress plugin ecosystem.

Technical ContextAI

The affected component is the Registration Form for WooCommerce plugin developed by ThemeGrill (CPE: cpe:2.3:a:themegrill:registration_form_for_woocommerce), a WordPress extension that augments WooCommerce's customer registration workflow. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns a user role or capability set that exceeds what should be granted during registration - typically because the form does not adequately sanitize or restrict role-related parameters submitted by the client. In WordPress, role assignment is a privileged operation; when a registration handler trusts client-supplied role/meta fields (e.g., 'role', 'wp_capabilities', or custom meta keys), an unauthenticated visitor can self-register as an administrator.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data - administrators should upgrade Registration Form for WooCommerce to the latest version above 1.0.9 as published by ThemeGrill and verify the installed version via the WordPress plugins screen. Until the update is applied, compensating controls include deactivating the plugin entirely (which disables the custom registration form and may force fallback to WooCommerce/WordPress default registration), restricting access to wp-login.php and the plugin's registration endpoint via web application firewall rules or .htaccess IP allow-lists (which may block legitimate new customer signups), and auditing wp_users / wp_usermeta for unexpected administrator accounts created since deployment. Patchstack vPatch customers can rely on the virtual patch referenced at https://patchstack.com/database/wordpress/plugin/registration-form-for-woocommerce/vulnerability/wordpress-registration-form-for-woocommerce-plugin-1-0-9-privilege-escalation-vulnerability.