← Back to search

CVE-2026-15989

9.8 CRITICALpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI risk analysis

Summary
The flaw allows unauthenticated attackers to register a new account with the Administrator role by exploiting the Super Forms – Drag & Drop Form Builder plugin's lack of proper role validation.
Exploitability
Exploitation is relatively easy as it requires injecting the 'role=administrator' parameter into a registration form. Precondition is that the form is publicly accessible.
Blast radius
If exploited, attackers could gain full administrative control over the WordPress site, leading to potential data breaches and unauthorized access to sensitive information.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Disable the Register & Login add-on or upgrade to version 6.3.317 or later.
auth-bypasswebwordpress

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.