CVE-2026-81431 is a privilege escalation vulnerability in the Registration Form for WooCommerce WordPress plugin before version 1.1.3. The plugin does not properly validate that the registration form referenced during user registration is legitimate. Instead, it reads the permitted-role allow-list from an attacker-controlled post. As a result, any user with the ability to create posts (Contributor role or higher) can exploit this flaw to register a new account with an arbitrary role, including Administrator, leading to full site compromise. This issue is a partial fix of an earlier vulnerability identified as CVE-2026-54807.

An attacker with Contributor or higher privileges can escalate their access by registering new accounts with arbitrary roles, including Administrator. This leads to full site takeover, compromising the integrity, confidentiality, and availability of the affected WordPress site.

No official fix or patch is currently available for this vulnerability. Users should upgrade to version 1.1.3 or later once released, as the issue affects versions before 1.1.3. Until a fix is available, restrict the ability to create posts to trusted users only and monitor for suspicious account registrations. Check the vendor advisory for updates on remediation.