Description

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-29T20:16:31.840Z",
  "pubdate": "2026-08-29T20:16:31.840Z",
  "executiveSummary": "The Custom User Registration Fields for WooCommerce plugin is susceptible to an unauthenticated privilege escalation vulnerability. The flaw exists in versions 2.2.3 and below, stemming from insecure processing of user-supplied data during the WooCommerce checkout flow.\nBy manipulating the afreg_select_user_role parameter within the WooCommerce Store API /wc/store/v1/checkout request, an unauthenticated attacker can override site-configured role assignments. This enables the assignment of arbitrary roles, including Administrator, to the newly registered user account upon order completion.\nThe vulnerability occurs because the plugin fails to sanitize or validate the user-provided role slug against an allowlist of authorized roles before passing it to the WordPress internal user management functions. This creates a critical security risk where attackers can gain full administrative control over the WordPress instance.\nSuccessful exploitation requires that the 'User Role Selection' feature be enabled within the plugin settings. No prior authentication is required, as the API endpoint is accessible to public visitors. The impact is catastrophic, leading to a complete compromise of the WordPress environment, potentially resulting in unauthorized data access, code execution, or site-wide disruption.",
  "technicalDetails": "The vulnerability originates in the af_reg_checkout_data_to_order_meta_data_block() function within the Custom User Registration Fields for WooCommerce plugin. This function processes data submitted via the WooCommerce Store API /wc/store/v1/checkout endpoint. During this process, the plugin retrieves the afreg_select_user_role parameter from the request payload and persists this value directly into the order metadata without performing any security validation.\nSubsequently, the plugin triggers the af_reg_custom_order_processing_function(), which is hooked into the woocommerce_thankyou action. This function retrieves the unsanitized role slug from the order metadata and passes it as a parameter to the WP_User::add_role() method. Because there is a complete absence of validation against a predefined set of allowed roles, the plugin effectively trusts the attacker-supplied input implicitly.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker initiates a checkout process via the Store API. 2) The attacker injects the afreg_select_user_role parameter into the JSON request body, setting the value to an elevated role string, such as 'administrator'. 3) Upon reaching the thank-you page after payment or order completion, the woocommerce_thankyou hook executes. 4) The server-side code extracts the malicious role string from the order meta and invokes add_role(), assigning the desired privilege level to the user account created during the session.\nThis vulnerability is classified as improper input validation leading to privilege escalation. The scope of the issue affects all plugin versions up to and including 2.2.3. The lack of an internal authorization check—where the plugin should match the submitted role against an admin-configured list of permitted roles—is the primary root cause. Because the exploitation occurs via an unauthenticated API endpoint, it poses a significant threat to any public-facing WooCommerce site that has enabled the 'User Role Selection' functionality. Once the attacker successfully elevates their account to an administrator role, they gain unrestricted access to the WordPress administrative dashboard, enabling the installation of malicious plugins, modification of site content, and potential remote code execution via file management or plugin/theme editors."
}