Registration Form for WooCommerce EUVD-2026-75266

Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (the minimum role that can create posts). The affected plugin must be installed and active, and the site must be running a version of the plugin prior to 1.1.3. Exploitation does not require any special site configuration beyond the plugin's presence. The most exposed sites are those that permit open or semi-open WordPress user registration (e.g., WooCommerce stores that allow customer account creation with Contributor roles). Sites where the Contributor role is restricted to fully trusted users face meaningfully lower practical risk. No user interaction beyond the attacker's own actions is required.

The official CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 7.2 and specifies PR:H (high privileges required), but the CVE description explicitly states exploitation is possible for 'Contributor and above' - a low-privilege WordPress role. This is a material discrepancy: if PR:L is correct (as the description implies), the CVSS base score rises to approximately 8.8. SSVC rates Technical Impact as 'total' (consistent with Administrator account creation leading to full site compromise) and Automatable as 'no' (requiring prior Contributor access). SSVC Exploitation is 'none,' which conflicts with the presence of a publicly available proof-of-concept from WPScan - that status may not yet reflect the PoC publication. The combination of a PoC, low effective barrier to exploitation (Contributor accounts are often granted to external users on content-heavy WordPress sites), and a path to Administrator-level takeover makes this a genuine priority for any site running WooCommerce with open or semi-open user registration. The SSVC automatable:no rating is credible given the prerequisite Contributor account.

An attacker registers or is granted a Contributor account on a WooCommerce site (common on stores allowing public registration or content contribution). The attacker creates a WordPress post containing a crafted role allow-list that includes 'Administrator', then initiates the plugin's registration flow while supplying that post's ID as the form reference parameter. The plugin reads the allow-list from the attacker-controlled post and creates a new Administrator account, which the attacker then uses to install malicious plugins, exfiltrate customer data, or fully compromise the site. A public PoC from WPScan confirms this flow is demonstrable.