CVE-2026-54807
CRITICALWordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-54807. PoCs published by izxci.
AI-analyzed exploit summary The repository contains a functional exploit script for CVE-2026-54807, which demonstrates an unauthenticated privilege escalation vulnerability in WooCommerce. The script automates the creation of an admin user by exploiting a registration form flaw.
Description
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
Exploits (1)
nomisec
WORKING POC
by izxci · poc
https://github.com/izxci/CVE-2026-54807
The repository contains a functional exploit script for CVE-2026-54807, which demonstrates an unauthenticated privilege escalation vulnerability in WooCommerce. The script automates the creation of an admin user by exploiting a registration form flaw.
Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target:
WooCommerce (version not specified)
No auth needed
Prerequisites:
Target site with vulnerable WooCommerce installation · Access to registration form
mistral-large-3 · analyzed Jun 26, 2026
Full analysis →
References (1)
Core 1
Scores
CVSS v3
9.8
EPSS
0.0044
EPSS Percentile
35.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-266
Status
published
Products (1)
ThemeGrill/Registration Form for WooCommerce
< 1.0.9
Published
Jun 17, 2026
Tracked Since
Jun 17, 2026