Threats tagged 'ghsa-rg35-vr3j-6cfx'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.2	EPSS 0.5%	CVE-2026-81431The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead High7.2EPSS 0.5%2026-09-10GCVE DatabaseCVE-2026-81431 The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807. EPSS 0.5%Report on CVE-2026-81431 Vulnerability CWE-269 #ghsa-rg35-vr3j-6cfx	GCVE Database	2026-09-10

Page 1 of 1