WooCommerce Plugin Privilege Escalation

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation.

Versions up to, and including, 2.2.3 are affected. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validation.

This allows unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.