Privilege Escalation in Custom User Registration Fields for WooCommerce Plugin

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to a critical privilege escalation flaw identified as CVE-2026-15369. The vulnerability affects versions up to and including 2.2.3. It stems from improper input validation within the WooCommerce Store API. Specifically, the af_reg_checkout_data_to_order_meta_data_block function accepts a user-controlled parameter, afreg_select_user_role, via the /wc/store/v1/checkout endpoint.

When the "User Role Selection" feature is enabled in the plugin settings, this input is persisted into order metadata. The af_reg_custom_order_processing_function, which executes during the woocommerce_thankyou hook, retrieves this unvalidated value and passes it directly to the WP_User::add_role() function. Because there is no check against an allowlist of permitted roles, an unauthenticated attacker can manipulate the checkout request to elevate their account permissions to Administrator or other sensitive roles. This flaw poses a significant risk to the integrity and confidentiality of affected WordPress installations.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative access to a compromised WordPress site. This leads to full administrative control, enabling the attacker to execute arbitrary code via plugin/theme installation, modify site content, exfiltrate user databases, or deploy persistent backdoors. Given the ubiquity of WooCommerce, this vulnerability impacts any e-commerce site running the affected plugin version with the specific feature enabled.

Recommendation

Prioritized actions for detection engineering and security operations teams:

• Update the "Custom User Registration Fields for WooCommerce" plugin to a patched version beyond 2.2.3 immediately.
• If an update is not immediately available, disable the "User Role Selection" feature in the plugin settings to mitigate the primary vector of this vulnerability.
• Review web server access logs for anomalous POST requests to the /wc/store/v1/checkout endpoint, particularly those containing suspicious strings or unexpected JSON parameters in the request body.