CVE-2026-13152 — Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation

CVE-2026-13152

Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation PUBLISHED

Description (CNA)

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

Affected (CNA)

Vendor / product	Versions
Unknown / Custom Fields Account Registration For Woocommerce	affected 0 before 1.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/36aaba38-3143-4e80-8386-748632ff6704/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.