Stores using ThemeGrill’s Registration Form for WooCommerce plugin should install version 1.1.5. A checkout account-creation flaw can let a visitor obtain Administrator privileges, according to Wordfence’s CVE submission.
The issue, CVE-2026-119075, affects versions through 1.1.4 and carries Wordfence’s CVSS 3.1 score of 9.8, Critical. Authentication and user interaction are not required in that assessment.
A missing check in the checkout path
In the CVE Program’s record, Wordfence describes a missing check: a submitted role reaches the new customer account without being restricted to the form’s permitted roles. The separate My Account registration path already checks that list.
The relevant exposure is account creation during checkout through the affected plugin. This advisory does not describe a flaw in WooCommerce core or establish that every WooCommerce store is affected.
The plugin’s official changelog dates version 1.1.5 to November 6, 2026, and identifies the checkout role-escalation fix. Version 1.1.4 is not sufficient.
Wordfence’s timeline records disclosure on November 6; the CVE record was published November 7. CISA’s enrichment recorded no exploitation on November 7. That cannot rule out unreported attacks.
Update, then check existing accounts
DaySec recommends confirming the installed plugin version after updating and testing a normal customer registration and checkout. Review Administrator accounts for unexpected additions, particularly recent accounts that do not correspond to approved staff.
Installing a fix closes the vulnerable path; it does not remove an account an attacker may already have created. If an unfamiliar administrator is found, preserve relevant registration and access records and investigate the account’s activity rather than treating the update alone as cleanup.
