Unauthenticated account creation via unchecked registration submissions

Improper access control in WPEverest User Registration & Membership before 5.2.6 allows remote attackers to create WordPress accounts. The unauthenticated AJAX registration handler accepts a published or draft form identifier and processes submitted credentials without enforcing the WordPress users_can_register option; even a bogus nonce is accepted. A registration form must exist and open registration must be disabled; the resulting account receives only the form-configured role, tested as Subscriber, rather than an attacker-supplied role.