Executive brief
Custom User Registration Fields for WooCommerce is a WordPress plugin that allows store administrators to add custom registration fields and user role selection to their WooCommerce checkout forms. The plugin fails to properly validate user-supplied role assignments during account creation, allowing unauthenticated attackers to register accounts with administrator privileges. This completely bypasses access controls and grants attackers full control over the affected WordPress store, including the ability to modify products, access customer data, and remove legitimate users.
Technical details
The vulnerability is a privilege escalation flaw in the Custom User Registration Fields for WooCommerce plugin affecting versions up to 2.2.3. The af_reg_checkout_data_to_order_meta_data_block() function accepts an attacker-controlled afreg_select_user_role parameter from unauthenticated WooCommerce Store API requests (POST to /wc/store/v1/checkout), stores it in order metadata without validation, and later passes it directly to WP_User::add_role() in af_reg_custom_order_processing_function() without checking against the plugin's admin-configured allowed roles list. An attacker can craft a JSON request body during checkout to specify "administrator" or any other role slug, then upon order completion the hooked thankyou function assigns that role to the newly created account. The vulnerability requires the "User Role Selection" setting to be enabled by the store administrator; no authentication is needed to exploit it.
Affected products
- Addify Custom User Registration Fields for WooCommerce up to and including 2.2.3
Timeline
- 2026-08-29: disclosed