Unauthenticated Administrator escalation via unchecked role assignment

Privilege escalation in Addify Custom User Registration Fields for WooCommerce 2.2.3 and earlier allows remote attackers to gain Administrator access. The af_reg_checkout_data_to_order_meta_data_block() function stores the untrusted afreg_select_user_role checkout value in order metadata, and af_reg_custom_order_processing_function() passes it to WP_User::add_role() without checking the configured role allowlist. Exploitation requires User Role Selection to be enabled and results in an attacker-created account receiving the Administrator role.