Unauthenticated account approval bypass via action parameter

Missing authorization in WPEverest User Registration & Membership 5.1.5 and earlier allows remote attackers to bypass account approval. The is_admin_creation_process() method treats any request containing action=createuser as an administrator-driven creation without checking authentication, capability, or a nonce. A site must expose a registration form and enable administrator approval; the fallback submission path then creates an approved low-privilege account and suppresses the administrator notification.