IT SBIT Services
Schneeberger
DEEN
CVE tracker

Super Forms WordPress plugin: Unauthenticated privilege escalation via role parameter

CVE-2026-15989Critical 9.8Public exploit

← All vulnerabilities

Summary

The Register & Login add-on of Super Forms accepts a client-submitted 'role' value during registration and passes it to WordPress user creation without validation. An unauthenticated attacker can register a new account with the Administrator role by adding role=administrator to the submission of any published registration form. This leads to full control over the WordPress site.

Affected

  • Super Forms – Drag & Drop Form Builder (WordPress plugin), all versions up to and including 6.3.316
  • Register & Login add-on (affected through the same code path)
  • Precondition: a published Super Forms form with the registration action (register_login_action='register')

Fixed in

  • Super Forms 6.3.317 (according to WPScan; the vendor release notes do not name this CVE)
  • Newer builds exist (for example 6.3.320 LTS); verify the current build on the updates server
  • Check the Register & Login add-on version as well

Workaround

  • No vendor-published workaround.
  • Until patched, unpublish or disable public Super Forms registration forms.
  • Review WordPress user accounts for unexpected administrators.

Exploitation

  • Public proof-of-concept exploit code exists on GitHub and is indexed by Sploitus.
  • CISA SSVC: exploitation none, automatable yes, technical impact total.
  • No evidence of in-the-wild exploitation found; the CVE is not listed in the CISA KEV catalog. Absence from KEV does not prove absence of exploitation.

Our recommendation

  • Update Super Forms to 6.3.317 or later, including the Register & Login add-on, on every WordPress site.
  • Until the update is applied, disable public registration forms that use the registration action.
  • Check user lists for unexpected Administrator accounts and review logs for registrations with role parameters.
  • Do not run public PoC tools against systems you do not own or are not authorized to test.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:40.

Original description (NVD)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed