WordPress UserPro plugin versions prior to 4.9.21 suffers from a user registration privilege escalation vulnerability.