uListing < 1.7 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion

The /1/api/ulisting-user/role/save REST route did not perform capability and CSRF checks, allowing unauthenticated users to remove and add roles, as well as add capabilities to the blog.