CVE-2026-13152: WordPress WooCommerce Auth Bypass Bug

CVE-2026-13152 Overview

CVE-2026-13152 affects the Custom Fields Account Registration for WooCommerce WordPress plugin in versions before 1.4. The plugin fails to prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix. An unauthenticated attacker who registers an account can obtain the administrator role when a correspondingly named field has been configured. The flaw is classified under CWE-269: Improper Privilege Management.

Critical Impact
Unauthenticated attackers can escalate to administrator on WooCommerce sites running vulnerable plugin versions with non-default table prefixes, resulting in full site compromise.

Affected Products

Custom Fields Account Registration for WooCommerce plugin versions prior to 1.4
WordPress sites using WooCommerce with a non-default database table prefix
Sites that have configured custom registration fields matching the user capabilities meta key

Discovery Timeline

2026-07-27 - CVE-2026-13152 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-13152

Vulnerability Analysis

The Custom Fields Account Registration for WooCommerce plugin allows site administrators to define arbitrary custom fields that appear on the WooCommerce user registration form. During account creation, the plugin persists submitted field values into WordPress user meta records. The plugin does not enforce a deny list against sensitive meta keys, most notably the user capabilities key that WordPress uses to store role assignments.

WordPress stores user roles in a meta key named {prefix}capabilities, where {prefix} matches the site's database table prefix. On default installations, this key is wp_capabilities and the plugin's internal checks correctly block it. On installations that use a non-default table prefix, the corresponding capabilities meta key differs, and the plugin does not compute or filter the site-specific key. An unauthenticated user submitting the registration form can therefore write a serialized role array to the capabilities meta key and register as an administrator.

Root Cause

The root cause is [CWE-269] Improper Privilege Management. The plugin hardcodes assumptions about the WordPress table prefix rather than dynamically resolving the current site's capabilities meta key through the $wpdb->prefix global. This gap allows registration input to overwrite role-defining meta on non-default installations.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits the public WooCommerce registration form with a crafted custom field whose name matches the site-specific capabilities meta key (for example, customprefix_capabilities). The submitted value contains a serialized array assigning the administrator role. After registration completes, the attacker logs in with full administrative privileges. The attack complexity is elevated because the attacker must first determine the target's table prefix and the plugin must have a matching field configured.

No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-13152

Indicators of Compromise

New WordPress user accounts created through the public registration form that hold the administrator role.
User meta entries where a capabilities key matching the site prefix contains serialized role data written during registration rather than by an administrator action.
HTTP POST requests to /wp-login.php?action=register or WooCommerce my-account registration endpoints containing form fields named after the site's capabilities meta key.
Unexpected plugin installations, theme edits, or new administrator sessions immediately following a self-service registration event.

Detection Strategies

Audit the wp_usermeta table (or prefixed equivalent) for entries in the capabilities key whose creation timestamp aligns with user registration events for non-administrator accounts.
Inspect WooCommerce plugin settings to enumerate configured custom registration fields and flag any whose field name resembles a WordPress reserved meta key.
Enable WordPress and web server access logging to capture registration payloads containing suspicious field names.

Monitoring Recommendations

Alert on any role change to administrator that is not initiated by an existing administrator session.
Monitor plugin version inventory across WordPress estates and flag installations of Custom Fields Account Registration for WooCommerce below version 1.4.
Track anomalous administrator logins from newly created accounts within a short window of registration.

How to Mitigate CVE-2026-13152

Immediate Actions Required

Update the Custom Fields Account Registration for WooCommerce plugin to version 1.4 or later on every affected site.
Review all existing WordPress user accounts and remove any administrator accounts that were not provisioned by a trusted administrator.
Remove or rename any configured custom registration fields whose name resembles the site's capabilities meta key.

Patch Information

The vendor released version 1.4 of the plugin, which resolves the improper meta key filtering. Refer to the WPScan Vulnerability Report for the fixed version reference and remediation guidance.

Workarounds

Disable the Custom Fields Account Registration for WooCommerce plugin until the patched version is deployed.
Disable public user registration under WordPress Settings > General > Membership and the WooCommerce account settings if the plugin cannot be updated immediately.
Restrict access to the WooCommerce registration endpoint through a web application firewall rule that blocks form submissions containing field names ending in _capabilities.

bash

# Configuration example
# Verify installed plugin version via WP-CLI
wp plugin get custom-fields-account-registration-for-woocommerce --field=version

# Update the plugin to the fixed release
wp plugin update custom-fields-account-registration-for-woocommerce --version=1.4

# Audit administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_registered