External risk intelligence

Custom User Registration Fields for WooCommerce Privilege Escalation via Store API.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15369

The vulnerability exists within a WordPress plugin for WooCommerce, specifically affecting the checkout process via the public-facing WooCommerce Store API. As this API is designed to be accessible to unauthenticated users during the normal online purchasing flow, it is public-facing by design.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Custom User Registration Fields for WooCommerce plugin, potentially allowing unauthenticated attackers to gain administrative privileges on WordPress sites. This is due to improper validation of user roles during the checkout process when a specific plugin setting is enabled.

Unauthenticated users could gain admin access.
Plugin's checkout API is exposed and vulnerable.
Confirm if "User Role Selection" setting is enabled.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the WooCommerce Store API during checkout. This request manipulates user role selection, allowing the attacker to assign themselves an administrator role without prior authentication.

Unauthenticated access to the Store API.
Modifying user role during checkout.
Privilege escalation to administrator.

Live Threat

Current exploitation, exposure, and threat context

When the "User Role Selection" setting is enabled in the Custom User Registration Fields for WooCommerce plugin, an unauthenticated attacker could exploit this vulnerability by manipulating requests to the WooCommerce Store API. This could allow them to assign administrative privileges to a new user account created during the checkout process.

User accounts with administrative privileges.
API requests to assign user roles.
Unauthorized control of the WordPress site.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this vulnerability, the WooCommerce and WordPress administrators are likely responsible for remediation. The first practical step involves identifying all WooCommerce instances that utilize the Custom User Registration Fields plugin, confirming if the "User Role Selection" setting is enabled, and assessing if the affected API endpoint is externally accessible. Subsequently, work with the platform or development team to plan and execute a fix, coordinating with the plugin vendor if necessary.

Own by WooCommerce/WordPress administrators.
Verify "User Role Selection" is enabled.
Plan vendor coordination and apply fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Custom User Registration Fields for WooCommerce plugin?

This is a WordPress plugin that extends the standard WooCommerce checkout process by allowing site owners to collect extra information from customers. It adds custom fields to the registration or checkout forms, which administrators can use to capture specific user data, such as preferred user roles, during the purchasing flow.

What is the CVE-2026-15369 vulnerability?

This is a privilege escalation flaw classified as CWE-269 (Improper Privilege Management). It occurs when the plugin fails to check if a user is authorized to choose a specific role. Because the plugin blindly trusts a role request sent during checkout, an attacker can trick the system into assigning them administrative rights instead of a standard customer role.

How can an attacker trigger this vulnerability?

An attacker sends a specially modified request to the public WooCommerce Store API during the checkout process. This request includes a hidden parameter that requests an 'administrator' role. The bug is not triggered if the 'User Role Selection' feature is disabled in the plugin settings, as the vulnerable code path that processes these role requests would not be executed.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin, your site is likely exposed. Halo Surface Signal identifies this as an external threat because the vulnerability resides in the WooCommerce Store API. Since this API is designed to be accessible to anyone on the internet to facilitate purchases, the vulnerable entry point is exposed by default on any site running the plugin.

What should I do to secure my WordPress site?

First, check your plugin settings to see if 'User Role Selection' is currently enabled, as this is the primary requirement for exploitation. If you are using this feature, consider disabling it immediately while you coordinate with your development team to apply vendor updates. Prioritize verifying all user accounts to ensure no unauthorized administrative accounts were created recently.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.