A critical privilege escalation vulnerability in the Addify Custom User Registration Fields for WooCommerce plugin enables unauthenticated attackers to gain administrative control over the WordPress site.

The plugin fails to validate the afreg_select_user_role parameter during the WooCommerce checkout process, allowing unauthenticated users to inject arbitrary role slugs that are subsequently processed by the WP_User::add_role() function. This flaw relies on the User Role Selection setting being enabled in the plugin configuration.

Successful exploitation of this vulnerability grants an unauthenticated attacker full administrative privileges, leading to complete site compromise. Given the CVSS score of 9.8, this represents a critical risk that could result in total data theft, modification of site content, or the installation of malicious backdoors, causing severe reputational and operational damage.

Immediate Action: Disable the User Role Selection feature within the plugin settings immediately, and monitor for any available vendor patches or updates that address this logic flaw.

Proactive Monitoring: Review WordPress user account creation logs for suspicious activity and audit the list of users with Administrator roles to identify unauthorized accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /wc/store/v1/checkout endpoint containing unexpected role assignment parameters.

Public Exploit Available: Unknown.

This vulnerability is critical and requires immediate attention to prevent unauthorized administrative access. Administrators should disable the vulnerable feature immediately and prioritize applying the vendor update as soon as a fix becomes available to eliminate the underlying security risk.