security flaw: registering user to admin instead of default role

I just noticed that Ultimate members allows (somehow) registering user in a role that is not an assingned role for the form nor set in the settings as default (for example admin). Plugin sends me a emails about registration and waiting for a approval. It seems that this is not done via form as these users don’t have “info” nor provide mandatory information during registration.