The WooCommerce plugin 'Registration Form for WooCommerce' contains a flaw in its checkout registration logic. In affected versions up to 1.1.4, the function validating checkout fields stores the raw $_POST['user_roles'] value directly in the user data array without performing an allow‑list check. Consequently, an unauthenticated user can set the parameter ‘user_roles’ to ‘administrator’ when creating an account via checkout and be granted full administrative privileges. This vulnerability allows a remote attacker to take over the entire site and is classified as a privilege escalation weakness (CWE-269).

WordPress sites running the ThemeGrill 'Registration Form for WooCommerce' plugin up to and including version 1.1.4 are affected. No other vendors or products are known to be impacted by this issue.

The CVSS score of 9.8 indicates a critical severity. While the EPSS score is not available, the lack of any authentication requirement and the remote nature of the attack suggest a high likelihood of exploitation in practice. The vulnerability is not listed in the CISA KEV catalog, but the damaging impact—full site takeover—demands immediate attention. Attackers can exploit this by submitting user_roles=administrator during checkout, bypassing all validation checks and obtaining Administrator access.