Unauthenticated administrator creation via form-definition injection

Privilege escalation in form handling in DynamiApps Frontend Admin 3.29.2 and earlier allows remote attackers to create administrator accounts. When _acf_form is an array, validate_form skips the database lookup, create_record preserves supplied record data, and the user action's run method falls back to attacker-controlled field definitions. An exposed frontend submission path is required; a spoofed role_options value then bypasses the role check and creates a new administrator account without authentication.