Admin Users get created through Flamingo

This is really a critical issue. I have had multiple people who manage to create Administrator users through the Flamingo plugin. All of a sudden a new user appears and it is an adminstrator. I check Flamingo and the User is there, but no forms was filled because that person only appears under the address book, but not under Inbound Messages.

I use SUCURI Alert and here is what it shows:

Event: Post Update Website: http://micahshugs.org IP Address: 103.74.105.194 Reverse IP: 103.74.105.194 Date/Time: May 30, 2026 9:41 pm Message: Flamingo_contact status has been changed; details: ID: 1272,Old status: new,New status: publish,Title: [email protected]

I disabled the plugin for now until this is resolved.