Subscriber-to-Administrator escalation via unchecked form settings

Missing authorization in WPEverest User Registration & Membership 3.1.5 and earlier allows remote authenticated users to become administrators. The form_save_action() AJAX handler accepts registration-form settings after verifying only a nonce, without checking the manage_options capability, so a subscriber can set the default role to administrator. Subscriber-level access and a valid action nonce are required; the altered form then creates a new administrator account.