Unauthenticated privilege escalation via unchecked form role

Privilege escalation in Ultimate Member 2.6.7 through 2.12.1 allows remote attackers to register with administrator-equivalent access. The form submission handler accepts a submitted role when custom_field_roles() cannot resolve the profile form's permitted roles, then checks only registered site roles rather than the form allow-list. Exploitation requires public registration through an Ultimate Member form containing a role field; successful registration creates an account with attacker-selected capabilities.