Stores using ThemeGrill's Registration Form for WooCommerce plugin should update to version 1.1.5, after researchers disclosed a checkout flaw that can hand a stranger the keys to a WordPress site. The vulnerability, tracked as CVE-2026-119075, carries a score of 9.8 out of 10 from Wordfence, which submitted the CVE record.

The problem sits in the way the plugin handles account creation during checkout. When a customer registers while paying, the plugin is supposed to limit the role given to the new account to the roles the site owner has allowed on the form. Wordfence found that the checkout path did not apply that check. Instead, it stored the role value submitted with the request exactly as it arrived, and then passed it into the data used to create the new WordPress account.

That gap matters because the request needs no login and no special interaction. According to the CVE description, an unauthenticated attacker can supply a role value of administrator when creating an account at checkout. The site then creates that account with administrator privileges, giving the attacker full control over the site, including its settings, content, plugins and users.

The plugin's other registration route does not have the same weakness. Wordfence notes that the My Account registration path already validates the submitted role against the form's configured allowed roles. Only the checkout path, in the function FormHandler::validate_checkout_fields(), was missing the allow-list enforcement. The flaw therefore affects stores that use the plugin for checkout registration, rather than WooCommerce itself, and it does not mean that every WooCommerce store is affected.

Versions up to and including 1.1.4 are affected. The plugin's official changelog dates version 1.1.5 to 6 November 2026 and identifies it as the release containing the checkout role-escalation fix. Wordfence recorded disclosure on 6 November, and the CVE record was published on 7 November.

There is no public evidence so far that the flaw has been exploited. CISA's assessment, recorded on 7 November, listed exploitation as none, while rating the flaw as automatable with a total technical impact. It is not in CISA's Known Exploited Vulnerabilities catalogue, and no public exploit code was tracked at the time the record was published. That position can change quickly with a flaw this easy to reach, so the absence of reported attacks should not be read as a reason to delay the update.

Site owners should update the plugin and then check that the installed version is 1.1.5. The update closes the vulnerable checkout path, but it does not remove an administrator account that an attacker may already have created. Administrators should review the list of administrator accounts for recent additions that do not match approved staff, and investigate any unfamiliar account before removing it, preserving registration and access records that may help explain how it appeared.

The case is a reminder that a small difference between two registration paths can carry a large consequence. The My Account form checked the role; the checkout form did not. For a store, the practical lesson is to treat checkout as a security boundary, not only as a sales step, and to keep the plugins that touch account creation on the latest release.