CVE-2026-13152 – Unauthenticated Privilege Escalation / Admin Takeover – Custom Fields Account Re…

Summary

CVE-2026-13152 is a high-severity unauthenticated privilege escalation vulnerability in the Custom Fields Account Registration For WooCommerce WordPress plugin, affecting all versions before 1.4. By exploiting insufficient validation in how custom registration fields are saved to user metadata, an unauthenticated attacker can register an account and assign themselves the WordPress administrator role, resulting in full site takeover. The IONIX research team is tracking potentially affected assets and recommends immediate patching.

Technical details

• Root cause: The plugin saves user-submitted registration field values directly to WordPress user meta without adequately restricting which meta keys can be written. A prior fix introduced a blocklist intended to prevent fields from targeting the wp_capabilities meta key (which governs WordPress user roles), but the blocklist was anchored to the hardcoded wp_ prefix. On sites using a non-default database table prefix (e.g., shop_), the actual capabilities key is named {prefix}_capabilities — a value outside the blocklist’s scope — allowing the restriction to be bypassed entirely.
• Trigger condition: The target WordPress installation must use a non-default database table prefix (i.e., $wpdb->prefix is set to any value other than wp_). A custom registration field must also be configured with a slug that maps to the capabilities meta key under that prefix.
• Attack vector: Remote, unauthenticated. The attacker registers a new account via the standard WooCommerce My Account registration page, submitting a crafted field value that writes administrator to the user capabilities meta key. No prior authentication, user interaction, or special privileges are required.
• Impact: Full administrator account takeover — the attacker gains unrestricted access to the WordPress admin panel, enabling arbitrary content modification, installation of malicious plugins, credential theft, and complete site compromise. CVSS impact metrics are rated High across Confidentiality, Integrity, and Availability.

Affected software

• Custom Fields Account Registration For WooCommerce (WordPress Plugin) — all versions before 1.4

Severity

• CVSS v3.1 Base Score: 8.1 (High)
• Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• CWE: CWE-269 – Improper Privilege Management

Mitigation and recommended actions

• Immediate: Update the Custom Fields Account Registration For WooCommerce plugin to version 1.4 or later. Version 1.4 resolves the vulnerability by comparing the reserved-slug blocklist against the site’s actual runtime database table prefix ($wpdb->prefix) rather than the hardcoded wp_ value, and adds an equivalent defense-in-depth check at the point each field value is written to user meta.
• If immediate patching is not possible: Temporarily disable the plugin until the update can be applied. Additionally, consider restricting access to the WooCommerce registration endpoint at the network or WAF level to reduce the attack surface while remediation is planned.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-13152 at NIST
• WPScan Vulnerability Advisory