{"id":"CVE-2026-15989","published":"2026-10-01T08:16:51.233","lastModified":"2026-10-01T14:17:28.893","description":"The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/RensTillmann/super-forms/pull/205","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb62d35-3f0e-4733-8f7f-723d0f25b710?source=cve","tags":[]}],"exploitRefs":[{"url":"https://github.com/RensTillmann/super-forms/pull/205","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated attackers to register a new account with the Administrator role by exploiting the Super Forms – Drag & Drop Form Builder plugin's lack of proper role validation.","exploitability":"Exploitation is relatively easy as it requires injecting the 'role=administrator' parameter into a registration form. Precondition is that the form is publicly accessible.","blast_radius":"If exploited, attackers could gain full administrative control over the WordPress site, leading to potential data breaches and unauthorized access to sensitive information.","remediation":"Disable the Register & Login add-on or upgrade to version 6.3.317 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","wordpress"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:41:32.169Z"}}