Custom User Registration Fields for WooCommerce CVE-2026-15369

The exploit requires the plugin's 'User Role Selection' setting to be enabled (a non-default configuration); without it the vulnerable role-assignment path is not exercised. Given that setting, no authentication is required (PR:N) and no user interaction beyond the attacker completing their own checkout: the attacker sends a modified JSON body to the unauthenticated /wc/store/v1/checkout Store API endpoint with afreg_select_user_role set to 'administrator' (or any role slug), and the plugin persists and later applies it via WP_User::add_role() with no allow-list validation. Limiting factors: the target must run Custom User Registration Fields for WooCommerce ≤ 2.2.3 with the role-selection feature active, and the account-creation-during-checkout flow must be available.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects remote, unauthenticated, low-complexity exploitation yielding full compromise, which is consistent with the described attack. The one material caveat is that exploitation depends on the non-default 'User Role Selection' setting being enabled - a deployment condition the raw CVSS score does not capture, so real-world exposure is narrower than 9.8 alone implies. No EPSS score, KEV entry, POC, or SSVC data was provided; therefore there is no evidence of active exploitation and no public exploit identified at time of analysis. The signal quality is otherwise strong: the description names exact functions, the parameter, and the vulnerable code path, and the report comes from Wordfence, a credible source. Net: a genuinely high-priority issue for any site running this plugin with the role-selection feature on, but the config prerequisite means it is not universally exploitable across all installs.

An attacker browses to a store running the vulnerable plugin with 'User Role Selection' enabled, initiates a checkout that creates an account, and intercepts or crafts the /wc/store/v1/checkout Store API request to set afreg_select_user_role to 'administrator'. Once the order reaches the thank-you page, the plugin assigns the administrator role to the attacker's new account, giving full control of the site. No public exploit code was identified, but the attack requires only a standard HTTP client and no authentication.