Author-to-Administrator escalation via registration form role

Privilege escalation in weDevs WP User Frontend 3.6.5 and earlier allows remote authenticated users to gain Administrator access. The registration_form shortcode accepts an attacker-controlled role without sufficient controls, letting an Author publish a form that assigns Administrator. Author-level access and permission to publish the crafted registration form are required; using that form creates a new fully privileged account.