Subscriber-to-Administrator escalation via unchecked option updates

Missing authorization in Accessibility by AllAccessible 1.3.4 and earlier allows remote authenticated users to update arbitrary site options. The AllAccessible_save_settings function writes attacker-supplied option names and values without checking the caller's capabilities. Subscriber-level access is enough to enable registration and assign new users the Administrator role, permitting creation of an administrative account.