A high-severity privilege management flaw in the Registration Form for WooCommerce plugin allows authenticated users to escalate privileges to Administrator, creating a critical risk of full site compromise.

The plugin fails to validate form references during registration, allowing an attacker with Contributor-level access or higher to manipulate the user role allow-list. By pointing the registration process to an arbitrary post, an attacker can register new accounts with elevated permissions.

The ability for a low-privileged user to gain Administrator access represents a total compromise of the application environment. This vulnerability could lead to unauthorized data exfiltration, total loss of site control, and the deployment of persistent malicious content, justifying the high CVSS score of 7.2.

Immediate Action: Update the Registration Form for WooCommerce plugin to version 1.1.3 or later immediately.

Proactive Monitoring: Audit user account creation logs for suspicious activity, specifically looking for new users assigned administrative roles that were not created through standard administrative procedures.

Compensating Controls: Implement strict role-based access control (RBAC) policies and consider disabling self-registration features until the plugin has been patched.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete site takeover, this vulnerability poses a severe threat to any WordPress installation utilizing the affected plugin. Administrators should prioritize updating to version 1.1.3 as the primary method of remediation and review existing user accounts to ensure no unauthorized administrative accounts have already been created.