CVE-2026-15369 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The Custom User Registration Fields for WooCommerce plugin (≤ 2.2.3) permits unauthenticated attackers to assign any WordPress role, including Administrator, during checkout. All WordPress sites running this plugin are exposed to immediate privilege‑escalation risk, potentially compromising the entire web stack. Decision makers must approve emergency patch deployment or temporary mitigation within the next 24 hours.

Verified Facts

• The vulnerability exists in the Custom User Registration Fields for WooCommerce plugin versions up to and including 2.2.3 — NVD.
• An attacker‑controlled afreg_select_user_role value is accepted via the unauthenticated /wc/store/v1/checkout API endpoint and persisted to order meta — NVD.
• The persisted role value is passed directly to WP_User::add_role() without validation against the admin‑configured allowed role list, enabling elevation to Administrator — NVD.
• Exploitation requires the “User Role Selection” setting to be enabled in the plugin configuration — NVD.

Threat Classification

Privilege‑escalation exploit targeting WordPress e‑commerce sites (Enterprise → Web Applications) with a global internet‑facing footprint; exploitation is currently active in the wild (public PoC) (HIGH CONFIDENCE). No specific attacker motivation is disclosed; the technique enables full system compromise for any motive (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Network‑remote, unauthenticated, low‑complexity (HIGH CONFIDENCE).
• Impact Scope: Single compromised WordPress instance grants full administrative control over the host and any connected services (HIGH CONFIDENCE).
• Prevalence: Plugin is widely used in WooCommerce stores; version 2.2.3 has been publicly released for months (MEDIUM CONFIDENCE).
• CVSS Score: 9.8 (Critical) reflects high confidentiality, integrity, and availability impact (HIGH CONFIDENCE).

Business Impact

Successful exploitation allows attackers to create or modify an admin account, leading to data breach of customer PII, PCI‑DSS scope transactions, and potential ransomware deployment. Under GDPR or NIS2, unauthorized access to personal data could trigger fines up to €20 million or 4 % of annual turnover. Operationally, the breach may force site shutdown, loss of sales revenue, and severe brand reputation damage.

Technical Analysis

• Attack Vector: HTTP POST to /wc/store/v1/checkout (JSON body) — Network‑remote, unauthenticated.
• Exploitation Chain: afreg_select_user_role → af_reg_checkout_data_to_order_meta_data_block() stores role in order meta → af_reg_custom_order_processing_function() calls WP_User::add_role() without whitelist check → admin privileges granted.
• Affected Component: Custom User Registration Fields for WooCommerce plugin (WordPress PHP code).
• Affected Versions: ≤ 2.2.3 (including 2.2.3).
• Root Cause: Missing validation of user‑supplied role against admin‑configured allowed list (CWE‑269: Improper Privilege Management).
• Exploit Requirements: “User Role Selection” setting must be enabled; no authentication needed.

CVE Analysis

• CVE‑2026‑15369 — Custom User Registration Fields for WooCommerce plugin ≤ 2.2.3 — CWE‑269 (Improper Privilege Management) — Network (N) / Remote (R) / Unauthenticated (N) — Patch available in version 2.2.4 (or later) (HIGH CONFIDENCE).

MITRE ATT&CK Mapping

• Initial Access → T1190: Exploit Public-Facing Application — attacker sends crafted checkout request to public API.
• Privilege Escalation → T1068: Exploitation for Privilege Escalation — role value bypasses validation and escalates to Administrator.
• Persistence → T1078: Valid Accounts — newly created admin account can be used for long‑term access.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• HTTP POST to /wc/store/v1/checkout containing JSON key afreg_select_user_role with value “administrator” or any non‑default role.
• Creation of new WordPress user accounts immediately followed by role assignment to “administrator”.
• Order meta records storing a role field that does not match the plugin’s allowed‑role list.
• Successful execution of WP_User::add_role() triggered from the woocommerce_thankyou hook.

Detection Engineering Guidance

• Web Server Access Logs (NGINX/Apache): monitor POST requests to /wc/store/v1/checkout with request body containing afreg_select_user_role.
• WordPress Debug Log (wp‑debug.log) or PHP error log: alert on calls to WP_User::add_role() where the source file is af_reg_custom_order_processing_function.php.
• WooCommerce Order Meta Table (wp_postmeta): flag entries where meta_key = “_afreg_user_role” and meta_value = “administrator”.
• WAF/IPS alerts: signature for JSON payloads modifying role fields in checkout API.
• Correlation rule: if a checkout API call with elevated role is followed within 5 minutes by a new admin user creation event, generate high‑severity alert.

Sigma Rules

title: WooCommerce Checkout Role Escalation Attempt
id: 3f9c2a1e-5d4b-4a9e-8f1c-2b6e7d9a0c3f
status: stable
description: Detects a POST request to the WooCommerce Store API checkout endpoint that includes a user‑role selection of administrator, indicating privilege‑escalation exploitation.
author: CYBERDUDEBIVASH Sentinel Apex
date: 2026-08-29
logsource:
    product: webserver
    service: nginx
detection:
    selection:
        http_method: POST
        url|contains: "/wc/store/v1/checkout"
        request_body|contains: '"afreg_select_user_role":"administrator"'
    condition: selection
falsepositives:
    - Legitimate admin testing of the plugin
level: high
tags:
    - attack.t1190
    - attack.t1068

Threat Hunting Queries

• Hypothesis: Unauthorized role assignment during checkout — Source: Web server access logs; query for POST */wc/store/v1/checkout* with request_body containing afreg_select_user_role and value not in allowed list.
• Hypothesis: New admin user creation following checkout — Source: WordPress audit log; query for event_type = "user_created" AND role = "administrator" AND timestamp within 10 minutes of checkout API call.
• Hypothesis: Order meta entries with rogue role values — Source: Database audit; query wp_postmeta where meta_key = "_afreg_user_role" AND meta_value = "administrator".
• Hypothesis: WAF alerts for JSON role manipulation — Source: WAF logs; query for rule_id = "WC_ROLE_ESCALATION" or similar signatures.
• Hypothesis: PHP error logs showing add_role() misuse — Source: php_error.log; query for "WP_User::add_role" AND "af_reg_custom_order_processing_function".

SOC Analyst Playbook

• P0 – Immediate (0‑1 hr): Pull web server access logs for the last 30 minutes; isolate any POST */wc/store/v1/checkout* with afreg_select_user_role = "administrator".
• P0 – Immediate (0‑1 hr): Query WordPress user table for newly created accounts with role administrator in the same timeframe; disable accounts.
• P1 – Urgent (1‑4 hr): Block the offending IPs at the firewall/WAF; enforce rate‑limit on the checkout endpoint.
• P1 – Urgent (1‑4 hr): Verify plugin version on all WordPress instances; schedule upgrade to ≥ 2.2.4.
• P2 – Same‑day (4‑24 hr): Review wp_postmeta for rogue role entries; clean any persisted admin roles.
• P2 – Same‑day (4‑24 hr): Document findings in the incident ticket and notify the CISO.

Executive Decision Matrix

Executive Recommendations

• Day 1‑7: Deploy version 2.2.4 or later across all WordPress sites; enforce WAF rule blocking afreg_select_user_role payloads; revoke any admin accounts created via the exploit.
• Day 8‑30: Conduct a plugin inventory audit to ensure no legacy versions remain; implement strict role‑selection configuration (disable “User Role Selection” unless required); integrate checkout API logging into SIEM.
• Day 31‑90: Adopt a hardened WordPress hardening baseline (disable file editing, enforce least‑privilege principle); establish a quarterly review of third‑party plugin CVE exposure; formalize an incident response playbook for privilege‑escalation exploits.

MSSP Opportunities

• Prioritize client notifications for any managed WordPress environments running the vulnerable plugin version.
• Deploy the provided Sigma rule and corresponding

🔗 Related Intelligence Reports

• Related topic: CVE-2026-14494 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82448 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82454 — CVSS 9.1 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82456 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82266 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record