Unauthenticated Administrator registration via unrestricted role assignment

Privilege escalation in WpOpal Opal Estate Pro 1.7.5 and earlier allows remote attackers to register accounts with the Administrator role. The on_regiser_user function accepts the requested registration role without restricting it to a safe role before assigning it to the new account. No authentication is required, and the resulting Administrator account grants control over the WordPress site.