CVE-2026-15897

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317

Description An issue exists in the Register & Login add-on where the before email success msg() function, during the register login action='update' flow, trusts a user-supplied user id value and passes it to wp update user() without verifying ownership or capabilities. Additionally, the super save form AJAX action lacks capability checks. This allows any authenticated user with Subscriber-level access or higher to create a malicious form and submit it with a target administrator's user id and new user pass or user email values, leading to account takeover and full site compromise.

Recommendations Update Super Forms – Drag & Drop Form Builder to a version newer than 6.3.316.