Super Forms: Privilege escalation via user_id in Register & Login add-on
Summary
Super Forms up to and including 6.3.316 for WordPress lets any authenticated user with Subscriber-level access or higher overwrite the credentials of other accounts, including administrator accounts. The Register & Login add-on updates a user identified by an attacker-supplied user_id without checking ownership or capabilities. Successful exploitation can lead to account takeover and full compromise of the WordPress site. The attack requires a valid low-privilege login; CVSS 3.1 base score is 8.8.
Affected
- Super Forms – Drag & Drop Form Builder up to and including 6.3.316
- Register & Login add-on: version unknown
- Affected range per CVE record: 0 to <= 6.3.316
Fixed in
- Fixed in 6.3.317 (according to WPScan; the vendor release notes do not name this CVE)
- Current stable release at time of research: 6.3.323
- Whether the 6.4.x beta line is affected: Unknown.
Workaround
- No vendor-documented workaround.
- Restrict or disable open registration if not needed.
- Review logs for AJAX requests to super_save_form.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV at time of research.
- No public proof-of-concept confirmed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: not yet computed.
Our recommendation
- Inventory all WordPress sites with Super Forms and record the version.
- Update Super Forms to 6.3.317 or later, preferably the current stable release, and check the changelog afterwards.
- Remove unused Subscriber accounts and close open registration if it is not required.
- Check administrator accounts for unexpected email address or password changes and for new administrator accounts.
- Monitor logs for requests to super_save_form and for NVD or KEV status changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- GitHub pull request #205 github.com
- WPScan plugin page for Super Forms wpscan.com
- Vendor release v6.3.317 github.com
- Super Forms documentation docs.super-forms.com
- OSV entry CVE-2026-15897 osv.dev
- Red Packet Security alert www.redpacketsecurity.com
- TheHackerWire CVE-2026-15897 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:52.
Original description (NVD)
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Because the super_save_form AJAX action also enforces no capability check, any authenticated user with Subscriber-level access and above can create the required malicious form (register_login_action='update' with register_login_user_id_update='true') and then submit it with user_id set to an administrator's ID along with a new user_pass/user_email. This makes it possible for authenticated attackers with Subscriber-level access and above to overwrite the credentials of arbitrary existing accounts — including administrators — resulting in account takeover and full site compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.