Vulnerabilities / Registration Form for WooCommerce / WPSEC-2026-2572
Registration Form for WooCommerce <= 1.1.3 - Unauthenticated Checkout Registration Field Validation Bypass
Medium 5.3
CWE-20Fixed in 1.1.4
- ID
- WPSEC-2026-2572
- Plugin
- Registration Form for WooCommerce (registration-form-for-woocommerce)
- Affected
- all versions before 1.1.4
- Remediation
- Update to 1.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Registration Form for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Registration Form for WooCommerce plugin for WordPress is vulnerable to a validation bypass in checkout registration in all versions up to, and including, 1.1.3. This is due to an inverted condition in the checkout validation routine that skips the plugin's field validation when account creation is mandatory at checkout. This makes it possible for unauthenticated attackers to create customer accounts during checkout without satisfying the required account fields configured in the plugin's checkout registration form, on sites that require an account to check out.
References
- https://wpsec.com/vuln/WPSEC-2026-2572/
- https://plugins.svn.wordpress.org/registration-form-for-woocommerce/tags/1.1.4/
- https://wordpress.org/plugins/registration-form-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS