Unauthenticated administrator registration via insecure default role

Privilege escalation in miniOrange OTP Verification with Firebase 3.6.0 and earlier allows remote attackers to register administrators. The registration handler reads default_user_role with administrator as its fallback and assigns that role when it creates a WordPress user. Unauthenticated access to the registration path is sufficient even when the site registration form is disabled, resulting in a new administrator account.