CVE-2026-13152 is an improper privilege management vulnerability (CWE-269) in the Custom Fields Account Registration For Woocommerce plugin for WordPress. Versions prior to 1.4 do not restrict custom registration fields from modifying the user capabilities meta key on installations with non-default database table prefixes. This flaw enables an unauthenticated attacker who registers an account to assign themselves the administrator role if a custom field with a matching name is configured. The vulnerability has a CVSS v3.1 score of 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can register an account and escalate privileges to administrator by exploiting the ability to write to the user capabilities meta key via custom registration fields. This results in full administrative control over the affected WordPress site, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid using non-default database table prefixes with this plugin or disable the plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.