**Content:**

Anyone visiting an online store can make themselves an administrator account at checkout, thanks to a critical flaw in a WooCommerce registration plugin disclosed on 7 November 2026.

The flaw, tracked as CVE-2026-119075, affects the Registration Form for WooCommerce plugin in versions up to and including 1.1.4. Wordfence, which assigned the CVE, scores it 9.8 out of 10 under CVSS, the critical band. The plugin is made by ThemeGrill.

A missing check at checkout

The plugin lets store owners design registration forms and choose which user roles customers may pick. On the My Account registration page, a submitted role is checked against that allow-list. On the checkout registration path, it is not.

The checkout handler stores the raw role value a visitor submits and passes it into the new customer record without any allow-list enforcement. An attacker simply supplies `user_roles=administrator` while creating an account during checkout, and the store hands them a full administrator account. No login, no payment and no special skill is required.

Full site takeover, no patch yet

An administrator account means complete control of the site: changing content, installing plugins, viewing customer and order data, and creating further accounts. The CVE record lists no fixed version as of 7 November, so there is no patch to install yet.

Store owners using the plugin should disable customer registration at checkout until a fix is released, or remove the plugin if it is not essential. They should also audit their user list for administrator accounts they do not recognise, and review recent orders for suspicious registrations.