WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.