WooCommerce Plugin Allows Unauthenticated Role Escalation

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Custom User Registration Fields for WooCommerce plugin versions up to 2.2.3 contain a critical privilege escalation vulnerability that allows unauthenticated attackers to elevate their account privileges to administrator or other high-level roles. The flaw exists in the checkout API endpoint where user-supplied role parameters bypass authentication checks and are directly passed to WordPress user role assignment functions. Any WordPress site running this plugin with WooCommerce is vulnerable, making this a widespread threat affecting e-commerce platforms that rely on this popular registration extension.

Casky's 224 matched security skills detect the attack patterns underlying this vulnerability by analyzing improper access control mechanisms (CWE-269) against MITRE ATT&CK's Privilege Escalation techniques (TA0004). Practitioners using Casky's Claude AI-powered analysis would identify findings showing: unauthenticated API requests containing role parameters, direct parameter-to-function assignments without validation layers, and suspicious order metadata containing role values. The extended reasoning capabilities flag the dangerous pattern of accepting untrusted user input from public API endpoints and immediately passing it to privileged WordPress functions without intermediate authorization checks—a classic privilege escalation chain that defenders should recognize and remediate immediately.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15369.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15369

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15369. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn