Unauthenticated administrator creation via unchecked registration role

Missing authorization in bPlugins bBlocks 2.0.6 and earlier allows remote attackers to create WordPress administrator accounts. The rgfr_registration() handler accepts an attacker-controlled role during registration and creates the user without authorization or validation that excludes privileged roles. No prior account or user interaction is required, and the resulting administrator account grants control over the WordPress site.