CVE-2026-15369 Addify CVE debrief

Who should care

WooCommerce and WordPress users with Custom User Registration Fields for WooCommerce plugin installed, especially those with 'User Role Selection' setting enabled, should review and apply vendor remediation when available. Affected operators and platforms should prioritize vulnerability management and security teams should monitor for suspicious activity and implement compensating controls if necessary. Immediate attention is required to mitigate this critical vulnerability with a CVSS score of 9.8, allowing unauthenticated attackers to escalate privileges to Administrator. This vulnerability impacts users with the plugin installed and configured to allow user role selection during checkout. Users should verify their plugin versions, review configurations, and prepare for potential updates or mitigations. Security teams should also consider asset inventory and exposure review to identify and prioritize remediation efforts. Monitoring and detection capabilities should be reviewed to ensure they can identify potential exploitation attempts. Additionally, implementing compensating controls, such as role-based access restrictions, may be necessary for exposed systems while remediation is scheduled and verified. Exceptions should be tracked, and remediated assets should be retested before closing the item, with evidence documented. This vulnerability requires immediate attention due to its critical severity and potential for exploitation. Users should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented are crucial steps in managing this vulnerability. The 'User Role Selection'

Technical summary

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. An attacker can elevate privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validating against the plugin's admin-configured allowed role list.

Defensive priority

CVE-2026-15369 is a critical vulnerability with a CVSS score of 9.8, allowing unauthenticated attackers to escalate privileges to Administrator. Immediate attention is required to mitigate this vulnerability.

Recommended defensive actions

• Inventory and version checks for Custom User Registration Fields for WooCommerce plugin
• Verify 'User Role Selection' setting is disabled or restrict access to WooCommerce Store API
• Monitor for suspicious account creation and role changes
• Apply vendor remediation when available
• Consider compensating controls, such as role-based access restrictions

Evidence notes

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. Evidence is limited; verify with official records and vendor documentation. The exploit requires the 'User Role Selection' setting to be enabled. Defenders should verify affected scope, apply vendor remediation when available, and monitor for suspicious account creation and role changes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.