CVE-2026-81431: WooCommerce Registration Form Auth Bypass

CVE-2026-81431 Overview

CVE-2026-81431 affects the Registration Form for WooCommerce WordPress plugin in versions prior to 1.1.3. The plugin fails to validate that the form referenced during registration is a legitimate registration form. Instead, it reads the permitted-role allow-list from an arbitrary attacker-controlled post. Any authenticated user with Contributor privileges or higher can create a post that defines an allow-list including Administrator. That user can then register a new account with Administrator role, leading to full site takeover. This flaw is an incomplete fix of CVE-2026-54807.

Critical Impact
Authenticated low-privileged users can register new accounts with arbitrary roles, including Administrator, resulting in complete WordPress site compromise.

Affected Products

Registration Form for WooCommerce WordPress plugin versions before 1.1.3
WordPress sites running WooCommerce with the vulnerable plugin installed
Any site permitting Contributor-or-above user registration

Discovery Timeline

2026-09-10 - CVE-2026-81431 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81431

Vulnerability Analysis

The vulnerability is a Broken Access Control flaw combined with a Business Logic Error in the plugin's registration handler. When a user submits the registration form, the plugin accepts a post identifier that points to the form configuration. The handler reads the permitted-role allow-list from whatever post the request references, without verifying the post is an actual registration form managed by the plugin.

An attacker with Contributor or higher privileges can author a post containing the metadata fields the plugin inspects. By setting the allow-list to include Administrator, the attacker instructs the registration flow to accept Administrator as a valid role assignment.

This is the second attempt at fixing the same class of bug. CVE-2026-54807 addressed the initial disclosure, but the patch left the underlying trust boundary intact.

Root Cause

The root cause is missing validation of the post type and ownership of the object supplying the allow-list. The plugin trusts client-supplied identifiers to select security-critical configuration data. See the WPScan Vulnerability Report for technical details.

Attack Vector

An authenticated attacker with at least Contributor privileges creates a post containing crafted metadata declaring Administrator as a permitted registration role. The attacker then submits a registration request that references this post identifier. The plugin reads the attacker-controlled allow-list, honors the Administrator selection, and provisions the new account with full administrative privileges.

The vulnerability mechanism is described in the referenced advisory. No verified proof-of-concept code is published in the enriched data.

Detection Methods for CVE-2026-81431

Indicators of Compromise

Unexpected new WordPress user accounts assigned the Administrator role shortly after Contributor-level activity
Posts authored by Contributor accounts that contain plugin form metadata fields but are not published registration forms
Registration requests referencing post IDs that do not correspond to legitimate registration form posts
Correlation between a user's post-creation event and a subsequent account creation from the same IP or session

Detection Strategies

Audit the wp_users and wp_usermeta tables for accounts created after the plugin was installed and cross-reference their role assignments
Enable WordPress action logging on user_register and wp_insert_post events and alert on temporal proximity between the two
Inspect web server logs for POST requests to the plugin registration endpoint containing arbitrary post_id or form-reference parameters

Monitoring Recommendations

Ingest WordPress audit logs into a centralized SIEM and alert on any role escalation to Administrator
Monitor for creation of privileged accounts outside change-management windows
Track plugin file integrity and configuration changes on production WordPress hosts

How to Mitigate CVE-2026-81431

Immediate Actions Required

Update the Registration Form for WooCommerce plugin to version 1.1.3 or later immediately
Review all Administrator, Editor, and Shop Manager accounts and remove any not tied to a known identity
Rotate credentials and application passwords for all privileged WordPress accounts
Restrict user registration to the minimum role required and disable public Contributor sign-ups if not needed

Patch Information

Upgrade to Registration Form for WooCommerce version 1.1.3 or later. Refer to the WPScan Vulnerability Report for the fixed version reference. Note that this release supersedes the incomplete fix delivered for CVE-2026-54807.

Workarounds

Deactivate the Registration Form for WooCommerce plugin until the site can be updated to 1.1.3
Revoke Contributor and higher post-creation privileges from untrusted users until the patch is applied
Deploy a Web Application Firewall rule to block registration requests that reference post IDs outside the known registration-form set

bash

# Configuration example: verify installed plugin version using WP-CLI
wp plugin get registration-form-for-woocommerce --field=version

# Update to the patched version
wp plugin update registration-form-for-woocommerce --version=1.1.3

# List all Administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered