Custom Fields Account Registration For Woocommerce
Monthly
An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.
An unauthenticated user registering on a WordPress site with the Custom Fields Account Registration for WooCommerce plugin before version 1.4 can exploit improperly protected custom fields to overwrite the user capabilities meta key, granting themselves the administrator role. This occurs on sites using a non-default database table prefix where a correspondingly named field has been configured. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV.