CVE-2026-15369

Custom User Registration Fields for WooCommerce, a WordPress plugin used with WooCommerce stores, contains a critical unauthenticated privilege escalation flaw in versions up to and including 2.2.3. The plugin accepts an attacker-controlled 'afreg_select_user_role' value from the unauthenticated WooCommerce Store API checkout request (/wc/store/v1/checkout), persists it in order meta, and later passes it directly to WP_User::add_role() during order processing on the woocommerce_thankyou hook without validating it against the admin-configured allowed role list. An unauthenticated attacker who creates an account during checkout can modify the JSON body to request the administrator role (or any other role slug) and gain full administrative control of the site. Only sites running version 2.2.3 or earlier with the plugin's 'User Role Selection' setting enabled are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Update the plugin to a version newer than 2.2.3 as soon as a patched release is published (no fixed version number was provided in the source data), and verify the installed version on the WordPress Plugins page. As an interim mitigation, disable the plugin's 'User Role Selection' setting so checkout role data is not applied to newly created accounts. Also audit recently created user accounts for unexpected Administrator role grants, since successful exploitation adds the attacker-specified role.