CVE-2026-15369: Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the afregcheckoutdatatoordermetadatablock() function, persisting it in order meta, and then passing it directly to WPUser::addrole() in the afregcustomorderprocessingfunction() function (hooked to woocommercethankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated administrator account creation?
Sites using affected versions up to 2.2.3 are exposed only when the plugin's "User Role Selection" setting is enabled. An attacker can submit a checkout request without existing credentials and specify the administrator role slug.
What must an attacker do to exploit this issue?
The attacker must create an account during checkout and send a modified JSON request body to the unauthenticated WooCommerce Store API /wc/store/v1/checkout endpoint. The request supplies afreg_select_user_role with administrator or another chosen role slug.
How can administrators determine whether their configuration is at risk?
Check whether Custom User Registration Fields for WooCommerce is version 2.2.3 or earlier and whether "User Role Selection" is enabled. The vulnerable path processes the afreg_select_user_role value supplied during Store API checkout.
What mitigation is available if an update cannot be applied immediately?
Disable the plugin's "User Role Selection" setting. The provided exploit condition requires that setting to be enabled.