CVE-2026-15369

CVE-2026-15369 describes a privilege escalation vulnerability found in the "Custom User Registration Fields for WooCommerce" plugin for WordPress, affecting versions up to and including 2.2.3. This flaw allows an unauthenticated attacker to elevate their privileges to that of an Administrator. The vulnerability stems from the plugin's handling of the `afreg_select_user_role` value during an unauthenticated WooCommerce Store API `/wc/store/v1/checkout` request. The plugin accepts this attacker-controlled value and passes it directly to the `WP_User::add_role()` function without proper validation against the administrator-configured allowed role list. This enables attackers to create an account with elevated privileges by specifying "administrator" or another desired role slug in a modified JSON body during checkout, provided the "User Role Selection" setting is enabled.