CVE-2026-81431

CVE-2026-81431 is an improper privilege management flaw (CWE-269) in the Registration Form for WooCommerce WordPress plugin before version 1.1.3, which does not validate that the form referenced during registration is a legitimate registration form and instead reads the permitted-role allow-list from an arbitrary, attacker-controlled post. Any authenticated user with post-creation rights — Contributor role and above — can reference a crafted post during registration, bypassing the intended role restrictions and creating a new account with an arbitrary role, including Administrator. An attacker thereby gains full administrative control of the affected site (complete site takeover), with high impact on confidentiality, integrity, and availability. Sites running the plugin before 1.1.3 are affected, and because this is an incomplete fix of the earlier CVE-2026-54807, sites that applied that earlier patch may still be exposed. No public proof-of-concept or CISA KEV listing is known, and there is no confirmed exploitation in the wild as of this analysis.

What to do: Upgrade the plugin to version 1.1.3 or later; because this is an incomplete fix of CVE-2026-54807, being on the earlier patched version is not sufficient. Until patched, restrict registration and post-creation privileges to trusted users and audit the users list for accounts created with elevated roles (especially Administrator) that could indicate prior exploitation. Also review registration activity for requests referencing non-registration posts, which is the telltale of this bypass.