EUVD-2026-68134
GHSA-8fc6-vv8j-hx7j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network request (PR:N/AV:N) to the Store API grants Administrator, fully compromising confidentiality, integrity, and availability; the config prerequisite is a deployment condition, not attacker complexity, so AC:L is retained.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.
Articles & Coverage 2
AnalysisAI
Privilege escalation to Administrator in the Addify Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.2.3) lets unauthenticated attackers gain admin rights by supplying an arbitrary role slug during WooCommerce checkout. The plugin trusts an attacker-controlled afreg_select_user_role value from the unauthenticated Store API /wc/store/v1/checkout request and passes it straight to WP_User::add_role() without validating it against the admin-configured allowed role list. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploit requires the plugin's 'User Role Selection' setting to be enabled (a non-default configuration); without it the vulnerable role-assignment path is not exercised. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects remote, unauthenticated, low-complexity exploitation yielding full compromise, which is consistent with the described attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the available data, so update to any release newer than 2.2.3 once the vendor publishes one and monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/715723e7-5820-4a64-848f-f89b5b73a681?source=cve) and the product page (https://woocommerce.com/products/custom-user-registration-fields-for-woocommerce/) for a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable the 'User Role Selection' feature in the plugin settings or deactivate the plugin entirely to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today