CVE-2026-15989: Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wpinsertuser(), without validating the submitted role against the administrator-configured registeruserrole, without an allow-list, and without any currentusercan() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (registerloginaction='register').
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites running Super Forms version 6.3.316 or earlier are exposed if they have a published Super Forms registration form configured with register_login_action='register' and the Register & Login add-on is in use.
What does an attacker need to do to exploit this issue?
An attacker does not need an existing account, privileges, or user interaction. They can submit registration data to an affected published form with role=administrator to create an Administrator account.
Does the configured registration role prevent exploitation?
No. The vulnerable function does not validate the submitted role against the administrator-configured register_user_role and does not use an allow-list or capability check.
How can administrators identify possible exploitation?
Review user accounts created through Super Forms registration forms for unexpected accounts assigned the Administrator role. Also identify published forms configured with register_login_action='register' on installations running version 6.3.316 or earlier.