CVE-2026-15369

The Custom User Registration Fields for WooCommerce plugin for WordPress (versions up to and including 2.2.3 ) is vulnerable to Privilege Escalation . The flaw exists because the af_reg_checkout_data_to_order_meta_data_block() function accepts an unauthenticated, attacker-controlled afreg_select_...

CVE-2026-15369: Improper Privilege Management

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...