CVE-2026-54807 WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

Q: What is CVE-2026-54807?

CVE-2026-54807 is a critical vulnerability in ThemeGrill Registration Form for WooCommerce, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2026-54807 being exploited?

There is no known exploitation of CVE-2026-54807 in the wild and no public exploit code.

Q: How do I fix CVE-2026-54807?

No fix has been published for CVE-2026-54807 yet. Limit exposure of the affected software until one is available.

Critical 9.8 Published 17 Jun 2026 Updated 17 Jun 2026

Unauthenticated attackers can escalate privileges in the Registration Form for WooCommerce plugin, allowing unauthorized access to higher-level functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-54807?

CVE-2026-54807 is a critical vulnerability in ThemeGrill Registration Form for WooCommerce, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

Weakness: CWE-266

Which versions are affected by CVE-2026-54807?

How do I fix CVE-2026-54807?

No fix has been published for CVE-2026-54807 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-54807 being exploited?

There is no known exploitation of CVE-2026-54807 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-fvvm-v9xg-j7m3.