Unauthenticated administrator creation via unchecked role parameter

Privilege escalation in Dreams Technologies Truelysell Core 1.8.7 and earlier allows remote attackers to create administrator accounts. The registration path accepts the attacker-controlled user_role parameter without restricting it to permitted roles and assigns that role to the new account. No authentication or user interaction is required; an attacker who can reach registration obtains full WordPress administrator privileges.