CVE-2026-119075: Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validatecheckoutfields() function in versions up to, and including, 1.1.4 The My Account registration path (validatefields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validatecheckoutfields(), hooked to woocommerceaftercheckoutvalidation) stores the raw $POST['userroles'] value in $this->validdata without any allow-list enforcement, and adduserdata() then injects that value into woocommercenewcustomerdata as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a userroles=administrator parameter when creating an account during checkout, resulting in full site takeover.