WordPress - Custom User Registration Fields For WooCommerce - CRITICAL - CVE-2026-15369. The Custom User Registration Fields for WooCommerce plugin allows unauthenticated users to exploit a vulnerability that can lead to privilege escalation. In versions up to and including 2.2.3, the plugin processes an attacker-controlled 'afreg_select_user_role' value through the WooCommerce Store API during checkout. This compromised value is directly passed to the WP_User::add_role() function without sufficient validation against the admin-configured roles. If the 'User Role Selection' feature is enabled, attackers can create accounts with elevated privileges, such as Administrator, by manipulating the JSON body of the checkout request.