CVE-2026-15989

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wpinsertuser(), without validating the submitted role against the administrator-configured registeruserrole, without an allow-list, and without any currentusercan() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (registerlogin_action='register').