# Registration Form for WooCommerce <= 1.1.3 - Unauthenticated Protection Mechanism Bypass via Direct WooCommerce Registration Request

- **ID:** WPSEC-2026-2571
- **Plugin:** Registration Form for WooCommerce (`registration-form-for-woocommerce`), https://wordpress.org/plugins/registration-form-for-woocommerce/
- **Affected versions:** all versions before 1.1.4
- **Fixed in:** 1.1.4 (Update to 1.1.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/registration-form-for-woocommerce
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2571/

## Description

The Registration Form for WooCommerce plugin for WordPress is vulnerable to a protection mechanism bypass in all versions up to, and including, 1.1.3. This is due to the plugin not requiring its own registration form nonce and a valid, published, exposed form ID when a custom My Account registration form is configured. WooCommerce's native registration handler therefore accepts requests sent directly to it, or naming a draft, private or unexposed form. This makes it possible for unauthenticated attackers to register accounts while bypassing the required fields and reCAPTCHA protection configured by the site owner, provided WooCommerce account registration is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2571/
- https://plugins.svn.wordpress.org/registration-form-for-woocommerce/tags/1.1.4/
- https://wordpress.org/plugins/registration-form-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2571/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.