The Custom User Registration Fields for WooCommerce plugin is vulnerable to unauthenticated privilege escalation due to the afreg_select_user_role parameter in the WooCommerce Store API checkout endpoint. The plugin accepts an attacker‑controlled role value, stores it in order meta, and later passes it unchecked to WP_User::add_role, allowing an unauthenticated attacker to create an account as an Administrator or any other role. This flaw arises because the value is not validated against the admin‑configured allowed role list and the "User Role Selection" setting must be enabled for the exploit to work.

Vulnerable systems are any WordPress sites running the Addify:Custom User Registration Fields for WooCommerce plugin version 2.2.3 or earlier. The flaw exists in the checkout flow of WooCommerce where the Store API endpoint /wc/store/v1/checkout is exposed to external requests.

The CVSS score of 9.8 indicates a critical severity and the lack of authentication requirement makes exploitation straightforward when the plugin is present. The EPSS score is not provided, but the absence of a KEV listing does not diminish the urgency given the high CVSS and the plain‑text nature of the parameter. An attacker can trigger the exploit by sending a crafted JSON body to the checkout API without needing any credentials, and if the "User Role Selection" setting is enabled, the account will be created with administrative privileges. Given the ease of input and the absence of mitigation in the default configuration, the risk is high for unpatched or misconfigured installations.