CVE-2026-15897 in Super Forms Plugin
Summary
by MITRE • 10/02/2026
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Because the super_save_form AJAX action also enforces no capability check, any authenticated user with Subscriber-level access and above can create the required malicious form (register_login_action='update' with register_login_user_id_update='true') and then submit it with user_id set to an administrator's ID along with a new user_pass/user_email. This makes it possible for authenticated attackers with Subscriber-level access and above to overwrite the credentials of arbitrary existing accounts — including administrators — resulting in account takeover and full site compromise.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The Super Forms – Drag & Drop Form Builder plugin, specifically versions up through 6.3.316, contains a critical privilege escalation vulnerability that allows authenticated attackers with minimal privileges to seize control of administrative accounts on WordPress sites. This flaw resides within the Register and Login add-on, which is designed to facilitate user registration and authentication workflows via form submissions. The core technical deficiency lies in the before_email_success_msg() function, particularly when operating under a register_login_action set to update. In this specific flow, the application logic blindly trusts an attacker-supplied user_id parameter without performing any verification of ownership or capability checks. This lack of validation means that the system does not confirm whether the authenticated user submitting the form has permission to modify the target account identified by the provided ID.
The operational impact is severe because the vulnerability leverages the super_save_form AJAX action, which also lacks adequate capability enforcement. An attacker with Subscriber-level access or higher can construct a malicious form configuration that triggers this vulnerable code path. By setting register_login_action to update and enabling register_login_user_id_update, the attacker gains control over the user identification process. When such a form is submitted, it includes a user_id field pointing to an administrator account, alongside new credentials in the form of a user_pass or user_email parameter. The wp_update_user() function then processes these inputs directly, effectively allowing the low-privileged user to overwrite the password and email address of any existing high-privilege account on the platform.
This vulnerability leads directly to full site compromise through account takeover. Once an attacker successfully updates the credentials of an administrator account using this method, they can log in with elevated privileges. This grants them unrestricted access to all WordPress functionalities, including the ability to install malicious plugins, modify core files, exfiltrate sensitive database information, and potentially pivot to other systems within the network infrastructure. The ease of exploitation means that even users with the lowest level of authenticated access on a typical WordPress installation can escalate their privileges to root-level administrative control without requiring any additional external tools or complex attack vectors beyond standard form submission capabilities.
From a classification perspective, this issue aligns with CWE-269, which describes Improper Privilege Control, as well as CWE-807, relating to Reliance on Untrusted Inputs in Security Decision. In the context of the MITRE ATT&CK framework for enterprise security, this vulnerability facilitates lateral movement and privilege escalation tactics, specifically mapping to techniques that involve exploiting misconfigurations or logic flaws within application layers to gain higher-level access. The attack vector is classified as remote with low complexity but requires authentication, highlighting the critical need for strict input validation and authorization checks in all user-facing endpoints.
Mitigation strategies must focus on immediate patching of the Super Forms plugin to a version that addresses this flaw by implementing robust ownership verification before processing updates. Developers should ensure that any function modifying user data verifies that the current authenticated session has explicit permission to alter the specific target resource, rather than relying solely on input parameters provided by the client side. Additionally, enforcing strict capability checks within AJAX handlers like super_save_form is essential to prevent unauthorized modification of critical system accounts. Until patches are applied, site administrators should consider restricting access to form submission endpoints or implementing additional server-side validation layers that verify user permissions against database records before allowing any credential changes to proceed.