Contributor-to-Administrator escalation via unrestricted registration role

Privilege escalation in BuddyForms 2.8.11 and earlier allows remote authenticated users to create Administrator accounts through registration forms. The registration form builder lets nonadministrators save an arbitrary default role, and new registrants receive that stored role. Contributor-level access is required; exploitation creates a new administrator account rather than elevating the existing account.