VulnSocial

CVE-2026-15369Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 2 mentions (2026-08-29); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-08-29: 2Mentions · 2026-08-30: 2Mentions · 2026-08-31: 1PoC Mentioned / Linked · 2026-08-29: 1Patch / Workaround · 2026-08-30: 1Patch / Workaround · 2026-08-31: 1Technical Details · 2026-08-29: 1Technical Details · 2026-08-30: 2Technical Details · 2026-08-31: 108-2908-3008-31
Signal classification2 categories
Disclosure
480.0%
Patch
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-08-292
Disclosure2
2026-08-302
Disclosure1Patch1
2026-08-311
Disclosure1
Full discourse5 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 WordPress'teki Custom User Registration Fields for WooCommerce eklentisinde, saldırganların herhangi bir kimlik doğrulaması olmadan Administrator yetkisi elde etmesine izin veren kritik bir açık bulundu. (CVE-2026-15369) ➖ CVSS: 9.8 Critical ➖ Kimlik doğrulama gerektirmiyor ➖ Kullanıcı etkileşimi gerektirmiyor ➖ Etkilenen sürümler: **≤ 2.2.3** Saldırgan, WooCommerce Store API üzerinden afreg_select_user_role parametresini manipüle ederek kayıt sırasında kendisini Administrator rolüne yükseltebiliyor. ⚠️ Açığın çalışabilmesi için eklentide User Role Selection seçeneğinin etkin olması gerekiyor. WordPress/WooCommerce kullananların eklenti sürümlerini kontrol etmesi ve güncellemesi öneriliyor.

    Post summary

    CVE‑2026‑15369 is a critical unauthenticated privilege‑escalation flaw in the Custom User Registration Fields for WooCommerce plugin, allowing attackers to gain Administrator rights by manipulating the afreg_select_user_role parameter during registration; users should update or patch the plugin.

    0101151.5K
    2.3K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-15369 The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to… https://www.cve.org/CVERecord?id=CVE-2026-15369

    Post summary

    The text announces CVE-2026-15369, a privilege escalation flaw in the WooCommerce plugin affecting versions up to 2.2.3, with a link to the official CVE record.

    000111.9K
    58.0K followersView on X
  • Mr.Niko@_MrNiko
    Disclosure

    CVE-2026-15369 in Custom User Registration Fields for WooCommerce unauth → admin through checkout Store API role field CVSS 9.8 https://www.wordfence.com/threat-intel/vulnerabilities/id/715723e7-5820-4a64-848f-f89b5b73a681?source=cve

    Post summary

    CVE-2026-15369 is a critical privilege escalation flaw in WooCommerce’s custom user registration fields that lets unauthenticated users become admins via the Store API during checkout. The text provides vulnerability details but no evidence of active exploitation, patch, or PoC.

    00011182
    1.5K followersView on X
  • ADK Cyber@ADKCyber
    Patch

    High-severity CVE-2026-15369 (CVSS 9.8) impacts Custom User Registration Fields for WooCommerce up to 2.2.3 with privilege escalation risk. Update the plugin if in use: https://nvd.nist.gov/vuln/deta… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/5dZpYhWJI1

    Post summary

    The tweet highlights high‑severity CVE‑2026‑15369, a privilege‑escalation flaw in WooCommerce Custom User Registration Fields, and urges users to update the plugin.

    0001045
    95 followersView on X
  • SecNews@SecNews_GR
    Disclosure

    CVE-2026-15369: Κρίσιμη ευπάθεια WooCommerce χαρίζει δικαιώματα διαχειριστή https://secn.ws/hKqQ7H

    Post summary

    A new CVE (CVE-2026-15369) in WooCommerce is announced as critical, with the capability to grant administrator privileges, though the announcement lacks detailed technical information, exploits, or mitigation guidance.

    00000212
    7.0K followersView on X

Explore more

Back to dashboard