WooCommerce Plugin Grants Unauth Users Admin Privileges

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-13152 is a critical privilege escalation vulnerability in the Custom Fields Account Registration For WooCommerce plugin that allows unauthenticated attackers to self-elevate to administrator role during account registration. The vulnerability exploits improper input validation on custom registration fields, which fail to sanitize data written to WordPress user capability meta keys—particularly dangerous on installations using non-default database table prefixes where validation logic breaks down. Any WooCommerce site running the affected plugin version before 1.4 is at risk, regardless of traffic volume or visibility, since the attack requires only basic account registration access that is typically public-facing.

Casky's 224 mapped skills detect this attack pattern through Claude's extended reasoning across MITRE ATT&CK Technique TA0004 (Privilege Escalation). Practitioners using Casky would observe detection signals aligned with account manipulation behaviors—specifically unusual meta key modifications during registration workflows, suspicious capability assignments to newly created accounts, and direct writes to user role fields from untrusted input sources. The platform would flag anomalous registration POST requests containing field payloads targeting wp_capabilities or similarly prefixed meta keys, combined with post-registration permission elevation patterns. Security teams would see CWE-269 (Improper Access Control) indicators in their findings, helping them correlate plugin configuration weaknesses with actual exploitation attempts in their WooCommerce environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13152.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-13152

Casky has 224 skills that investigate the attack patterns behind CVE-2026-13152. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn