Registration Form for WooCommerce <= 1.1.3 - Unauthenticated Protection Mechanism Bypass via Direct WooCommerce Registration Request
- ID
- WPSEC-2026-2571
- Plugin
- Registration Form for WooCommerce (registration-form-for-woocommerce)
- Affected
- all versions before 1.1.4
- Remediation
- Update to 1.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Registration Form for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Registration Form for WooCommerce plugin for WordPress is vulnerable to a protection mechanism bypass in all versions up to, and including, 1.1.3. This is due to the plugin not requiring its own registration form nonce and a valid, published, exposed form ID when a custom My Account registration form is configured. WooCommerce's native registration handler therefore accepts requests sent directly to it, or naming a draft, private or unexposed form. This makes it possible for unauthenticated attackers to register accounts while bypassing the required fields and reCAPTCHA protection configured by the site owner, provided WooCommerce account registration is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2571/
- https://plugins.svn.wordpress.org/registration-form-for-woocommerce/tags/1.1.4/
- https://wordpress.org/plugins/registration-form-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS