← Back to search

CVE-2026-15897

8.8 HIGHpublic exploit available

Published 2026-10-02 · Updated 2026-10-03

AI risk analysis

Summary
The Super Forms – Drag & Drop Form Builder plugin for WordPress allows attackers to escalate privileges by exploiting the Register & Login add-on, leading to account takeover and full site compromise.
Exploitability
Exploitation is relatively straightforward for any authenticated user with Subscriber-level access or higher, requiring the creation of a specific form and submission with an administrator's user_id.
Blast radius
If exploited, the impact is high, as it can result in the compromise of any existing account, including administrators, leading to full site control.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Disable the Register & Login add-on or upgrade to version 6.3.317 or later.
auth-bypasswebwp-plugin

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Because the super_save_form AJAX action also enforces no capability check, any authenticated user with Subscriber-level access and above can create the required malicious form (register_login_action='update' with register_login_user_id_update='true') and then submit it with user_id set to an administrator's ID along with a new user_pass/user_email. This makes it possible for authenticated attackers with Subscriber-level access and above to overwrite the credentials of arbitrary existing accounts — including administrators — resulting in account takeover and full site compromise.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.