{
 "id": "WPSEC-2026-2572",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2572/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2572/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2572/index.md",
 "title": "Registration Form for WooCommerce <= 1.1.3 - Unauthenticated Checkout Registration Field Validation Bypass",
 "description": "The Registration Form for WooCommerce plugin for WordPress is vulnerable to a validation bypass in checkout registration in all versions up to, and including, 1.1.3. This is due to an inverted condition in the checkout validation routine that skips the plugin's field validation when account creation is mandatory at checkout. This makes it possible for unauthenticated attackers to create customer accounts during checkout without satisfying the required account fields configured in the plugin's checkout registration form, on sites that require an account to check out.",
 "plugin": {
  "slug": "registration-form-for-woocommerce",
  "name": "Registration Form for WooCommerce",
  "full_name": "Registration Form for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/registration-form-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/registration-form-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/registration-form-for-woocommerce"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.1.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.1.4",
 "remediation": "Update to 1.1.4 or later.",
 "fix_released": "2026-11-04T10:47:32+00:00",
 "published": "2026-11-05T11:43:51+00:00",
 "updated": "2026-11-04T15:46:33.833566+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2572/",
  "https://plugins.svn.wordpress.org/registration-form-for-woocommerce/tags/1.1.4/",
  "https://wordpress.org/plugins/registration-form-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/registration-form-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}