Administrator escalation via unrestricted user metadata writes

Privilege escalation in Ultimate Member before 2.1.12 allows remote attackers to gain WordPress Administrator access through registration. The registration flow passes submitted fields to update_profile, which iterates over arbitrary keys and writes them with update_user_meta without blocking sensitive metadata. No prior account or user interaction is required; a crafted wp_capabilities array grants control of the newly created administrator account.