CVE-2026-15369— Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
Quick assessment
Affected
Addify Custom User Registration Fields for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 WooCommerce 自定义用户注册字段插件在 2.2.3 版本及更早版本中，存在权限提升（Privilege Escalation）漏洞。 该漏洞的成因是：插件在 函数中，接受来自未认证的 WooCommerce Store API 请求中由攻击者控制的 值，并将其持久化到订单元数据（order meta）中；随后，在挂载到 钩子的 函数中，该值被直接传递给 ，但并未针对插件后台配置的“允许的角色列表”进行验证。 这使得未认证的攻击者能够通过在结账时创建账户，并修改 JSON 请求体，将
Possible ATT&CK Techniques 1 AI
T1099Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Addify | Custom User Registration Fields for WooCommerce | ≤ 2.2.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15369
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
Source: CVE Program / CVE List V5
Vulnerability Description
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Addify | Custom User Registration Fields for WooCommerce | 0 ~ 2.2.3 | - |
|
II. Public POCs for CVE-2026-15369
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15369
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-15369 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-15369
No comments yet