CVE-2026-15897: Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg() function, in its registerloginaction='update' flow, trusting an attacker-supplied userid value and passing it to wpupdateuser() without any ownership or capability check. Because the supersaveform AJAX action also enforces no capability check, any authenticated user with Subscriber-level access and above can create the required malicious form (registerloginaction='update' with registerloginuseridupdate='true') and then submit it with userid set to an administrator's ID along with a new userpass/useremail. This makes it possible for authenticated attackers with Subscriber-level access and above to overwrite the credentials of arbitrary existing accounts — including administrators — resulting in account takeover and full site compromise.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrative privileges, but must be able to authenticate to the site.
What does an attacker need to do to take over an account?
The attacker can create a malicious form using the Register & Login add-on update flow, then submit it with the target account's user ID and replacement password or email address. No ownership or capability validation is performed for the supplied user ID.
Are administrator accounts at risk?
Yes. An attacker can overwrite credentials for arbitrary existing accounts, including administrators, which can lead to full site compromise.
Which installations are affected?
All versions of the Super Forms – Drag & Drop Form Builder plugin up to and including 6.3.316 are affected when the vulnerable Register & Login add-on functionality is present.