CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
Unauthenticated attackers can register as Administrator by injecting the role parameter into Super Forms registration forms, leading to full site compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15989?
CVE-2026-15989 is a critical vulnerability in WebRehab Super Forms – Drag & Drop Form Builder, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').
Weakness: CWE-269
Which versions are affected by CVE-2026-15989?
How do I fix CVE-2026-15989?
No fix has been published for CVE-2026-15989 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15989 being exploited?
There is no known exploitation of CVE-2026-15989 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-mjx4-cmxj-rrrw.