{"id":"CVE-2026-15989","revision":"629375a5ee5c4d97a9548d88d67f488f","records":[{"revision":"629375a5ee5c4d97a9548d88d67f488f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-15989","aliases":[],"title":"Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter","description":"The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').","state":0,"publishedAt":"2026-10-01T07:40:23.893+00:00","modifiedAt":"2026-10-01T13:47:45.799+00:00","affected":[{"ecosystem":"Vendor product","name":"Super Forms – Drag & Drop Form Builder","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"WebRehab\",\n                    \"product\": \"Super Forms – Drag & Drop Form Builder\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"6.3.316\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb62d35-3f0e-4733-8f7f-723d0f25b710?source=cve","https://github.com/RensTillmann/super-forms/pull/205"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-15989","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-15989","identifiers":["CVE-2026-15989"]},"retained":false,"historicalAffected":[]}],"coverage":[]}