Custom User Registration Fields for WooCommerce Plugin Unauthenticated Privilege Escalation

Technical Analysis

CVE-2026-15369 stems from the plugin's af_reg_checkout_data_to_order_meta_data_block() function accepting an attacker-controlled afreg_select_user_role parameter from the unauthenticated WooCommerce Store API endpoint /wc/store/v1/checkout. This value is persisted in order metadata and later passed unvalidated to WP_User::add_role() within af_reg_custom_order_processing_function(), hooked to the woocommerce_thankyou action, bypassing the plugin's admin-configured allowed role list. An attacker can submit a modified JSON body specifying 'administrator' as the desired role during account creation at checkout, achieving full Administrator privileges without authentication. Exploitation requires the plugin's 'User Role Selection' setting to be enabled, which is a common configuration for stores offering role-based registration (e.g., wholesale/retail tiers). Successful exploitation grants attackers full WordPress admin control, enabling plugin/theme installation, arbitrary code execution, and database access. While this is a WordPress/WooCommerce-specific vulnerability, organizations running AI-powered customer service agents, chatbots, or automation tools integrated with the compromised WooCommerce store (e.g., via REST API keys or webhooks) could have those credentials and integration points exposed if the site is fully compromised, warranting inclusion in agent-adjacent risk assessments for e-commerce environments using AI tooling.

Affected Systems

Custom User Registration Fields for WooCommerce WordPress plugin, versions up to and including 2.2.3, specifically installations with the 'User Role Selection' setting enabled

Indicators of Compromise

• No specific IOCs published; monitor for anomalous POST requests to /wp-json/wc/store/v1/checkout containing unexpected afreg_select_user_role values (e.g., 'administrator')
• Unexplained new administrator accounts created via checkout/order processes
• Unusual order meta entries referencing role slugs outside configured allowed list

Remediation Steps

1. 1

   Update Plugin

   Update Custom User Registration Fields for WooCommerce to the latest patched version beyond 2.2.3 immediately.

2. 2

   Disable Vulnerable Feature

   If an immediate update is not possible, disable the 'User Role Selection' setting in the plugin configuration to prevent exploitation.

3. 3

   Audit User Accounts

   Review all WordPress user accounts, especially those with Administrator role, created via checkout/registration for unauthorized additions.

4. 4

   Monitor API Requests

   Implement logging and monitoring for the WooCommerce Store API checkout endpoint to detect anomalous role-related parameters in requests.

5. 5

   Apply WAF Rules

   Deploy a web application firewall rule to block or flag checkout requests containing unexpected role-related JSON fields such as afreg_select_user_role.

6. 6

   Rotate Credentials

   If compromise is suspected, rotate all WordPress admin credentials, API keys, and any integrated third-party service tokens (including AI agent or automation integrations).