Unauthenticated role escalation via checkout parameter in Custom User Registration Fields for WooCommerce (CVE-2026-15369)
VulnCheck added this flaw to its known-exploited catalog on 2026-08-31 citing Patchstack's exploitation report, and stores running 2.2.3 or below can have attackers grant themselves privileged roles with a single unauthenticated checkout request.
Versions up to and including 2.2.3 accept an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persist it in order meta, and pass it straight to WP_User::add_role() when the order completes. An unauthenticated attacker can thereby assign themselves an arbitrary role, including administrator, on the target store.
Affected: Addify Custom User Registration Fields for WooCommerce <= 2.2.3
How to Test
Confirm whether the installed plugin version is 2.2.3 or lower; audit recent order meta for unexpected afreg_select_user_role values, review the user table for newly created or recently modified accounts holding administrator or other privileged roles, and check access logs for unauthenticated POSTs to /wc/store/v1/checkout carrying role parameters.
How to Mitigate
No fixed release is cited in the available evidence for versions through 2.2.3, so deactivate the plugin until the vendor publishes an update above 2.2.3; in the meantime remove any unexpected privileged accounts and rotate administrator credentials if suspicious role assignments are found.