Unauthenticated administrator creation via unrestricted role selection

Incorrect privilege assignment in Adding drop down roles in registration 1.1 and earlier allows remote attackers to gain administrator access. The registration handler accepts a user-selected role without restricting the choice to low-privilege roles, so an unauthenticated registrant can select Administrator. Public user registration must be reachable; a successful request creates an administrator account capable of taking control of the WordPress site.