WORDPRESS · AUGUST 2026 · EARLY WARNING

Custom User Registration Fields for WooCommerce Plugin Vulnerability Alert

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.8
Affected component: custom user registration fields for woocommerce (wordpress)
Patched version: Not yet available

CVE-2026-15369

An early warning has been issued regarding a critical vulnerability in the Custom User Registration Fields for WooCommerce plugin for WordPress. Users of affected versions are advised to take immediate action.

What happened

The Custom User Registration Fields for WooCommerce plugin for WordPress is reportedly vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This vulnerability allows unauthenticated attackers to elevate their privileges to Administrator by specifying a role during checkout. The vulnerability is under investigation and has been assigned the identifier CVE-2026-15369 with a CVSS score of 9.8.

This vulnerability poses a significant risk as it can be exploited by unauthenticated users to gain administrative control over a WordPress site. The potential impact includes unauthorized access to sensitive data, modification of site content, and the ability to install malicious code.

What to do about it

Upgrade to a version beyond 2.2.3 of the Custom User Registration Fields for WooCommerce plugin.
If a patch is available, apply it immediately to mitigate the risk.
Monitor the primary sources for updates on the vulnerability and any available patches.
Consider disabling the plugin temporarily if an immediate upgrade or patch is not possible.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If custom user registration fields for woocommerce is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using version 2.2.3 or earlier of the Custom User Registration Fields for WooCommerce plugin.

What should I do right now?

Upgrade to a version beyond 2.2.3 or apply a patch if available. Monitor primary sources for updates.

Is there an official fix available?

No official fix has been published yet. Monitor the sources for updates.

Sources

[CVE-2026-15369] CVSS 9.8 CRITICAL

Join the 0Day waitlist →

← Back to all threats