Vulnerability · Published Oct 1, 2026 · Assigned by Wordfence
CVE-2026-15989Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
Critical 9.8
In plain English
A critical-severity privilege mismanagement in Super Forms – Drag & Drop Form Builder from WebRehab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WebRehab | Super Forms – Drag & Drop Form Builder | 0 – through 6.3.316 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H