Subscriber-to-Administrator escalation via unrestricted option update

Privilege escalation in PenciDesign Soledad 8.6.9 and earlier allows remote authenticated users to create Administrator accounts. The penci_update_option AJAX handler validates a broadly available nonce but passes an attacker-selected global option to update_option without checking capabilities or restricting option names. Subscriber-level access exposes the nonce, enabling users_can_register and default_role changes that permit a new Administrator account and full site takeover.