What is CVE-2026-13152?
CVE-2026-13152 is a critical privilege escalation vulnerability in the 'Custom Fields Account Registration For Woocommerce' WordPress plugin prior to version 1.4. It fails to prevent custom registration fields from writing to the user capabilities meta key on sites with a non-default database prefix, allowing an unauthenticated attacker to gain administrative privileges upon account registration.
Azərbaycanca: CVE-2026-13152, 'Custom Fields Account Registration For Woocommerce' WordPress plaginində aşkarlanmış kritik bir boşluqdur. Plagin 1.4 versiyasından əvvəlki versiyalarda, xüsusi qeydiyyat sahələrinin istifadəçi imtiyazları (user capabilities) meta açarına yazılmasının qarşısını almır. Bu, autentifikasiya olunmamış istifadəçinin saytda qeydiyyatdan keçərək idarəçi imtiyazları əldə etməsinə imkan verir.
Related CVEs
link basis: same weakness class CWE-269
FAQ2
Under what conditions can CVE-2026-13152 be exploited?
This vulnerability can be exploited only when the WordPress site has a non-default database prefix and the 'Custom Fields Account Registration For Woocommerce' plugin version is prior to 1.4.
What can an attacker gain by exploiting CVE-2026-13152?
An unauthenticated attacker can gain administrative privileges by simply registering an account on the site.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.