LiveActive security incident?Get immediate response
CVE Record

CVE-2026-15369: Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

An unauthenticated shopper may be able to create an account with Administrator privileges during checkout. Successful exploitation could enable complete WordPress takeover, including access to customer data, store settings, content, and payment-related workflows. Exploitation requires the plugin’s User Role Selection setting to be enabled.

Executive priority

Treat affected, configured stores as an immediate remediation priority because successful exploitation could grant complete administrative control without authentication. Disable the required setting now, investigate recent privileged-account creation, and obtain a vendor-confirmed fixed version before restoring the feature.

Technical view

Versions through 2.2.3 accept an attacker-controlled role value through the WooCommerce Store API checkout request. The plugin stores that value in order metadata and later passes it to WordPress role assignment without checking the administrator-configured allowed roles, enabling arbitrary role assignment during account creation.

Likely exposure

Exposure requires Custom User Registration Fields for WooCommerce through version 2.2.3, enabled User Role Selection, and account creation during Store API checkout. Internet-accessible stores meeting those conditions should be treated as potentially exposed. The supplied affected-version field is inconsistent, but the vulnerability description explicitly states versions through 2.2.3.

Exploitation context

The attack is described as remote, unauthenticated, low complexity, and requiring no user interaction. The source bundle does not identify active exploitation, and the CVE is not marked as present in CISA KEV. Public exploit availability is not established by the supplied evidence.

Researcher notes

The vulnerable flow spans Store API checkout input, order metadata persistence, and role assignment on the WooCommerce thank-you hook. CWE-269 and CVSS 9.8 are consistent with unauthenticated arbitrary privilege assignment. No fixed version, vendor mitigation, active-exploitation evidence, or public exploit status is established in the supplied sources.

Mitigation direction

  • Immediately disable the plugin’s User Role Selection setting.
  • Inventory installations and prioritize every instance running version 2.2.3 or earlier.
  • Check Addify and WooCommerce guidance for a confirmed fixed release, then update promptly.
  • If no fix is available, consider temporarily deactivating the plugin or restricting checkout account creation.
  • Review and remove unauthorized privileged accounts using established incident-response procedures.

Validation and detection

  • Confirm the installed plugin version on every WordPress store.
  • Verify whether User Role Selection is currently enabled or was previously enabled.
  • Review newly created users for unexpected Administrator or other privileged roles.
  • Correlate suspicious privileged users with recent checkout orders and account creation activity.
  • After remediation, verify checkout-created accounts cannot receive roles outside the configured allowed list.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-269: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-15369 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
4Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Wordfence

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-15369Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineWordfence

    Disclosed

  3. CVE publishedCVE Program

    The CVE record was published.

  4. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AddifyCustom User Registration Fields for WooCommerce0unaffected
Weakness

CWE details

CWE-269

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-269 · source CWE mapping

Improper Privilege Management

Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs