CVE-2026-15369

Name of the Vulnerable Software and Affected Versions Custom User Registration Fields for WooCommerce versions prior to 2.2.4

Description An issue allows unauthenticated attackers to elevate their privileges to Administrator. This occurs because the plugin accepts an attacker-controlled afreg select user role value from the WooCommerce Store API endpoint '/wc/store/v1/checkout' within the af reg checkout data to order meta data block() function. The value is persisted in order meta and subsequently passed to the WP User::add role() function in the af reg custom order processing function() without being validated against the admin-configured allowed role list. An attacker can exploit this by creating an account during checkout with a modified JSON body specifying the desired role slug. This exploit requires the User Role Selection setting to be enabled.

Recommendations Update the plugin to a version newer than 2.2.3. Disable the User Role Selection setting as a temporary mitigation measure.