CVE-2026-119075

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate checkout fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate checkout fields(), hooked to woocommerce after checkout validation) stores the raw $ POST['user roles'] value in $this->valid data without any allow-list enforcement, and add user data() then injects that value into woocommerce new customer data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user roles=administrator parameter when creating an account during checkout, resulting in full site takeover.