Want everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.
The fact that the profile page doesn't have a "Make me an Admin" button is no defense - the attacker will be able to forge an HTTP request without any trouble.
