CVE-2026-15989

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317

Description An issue exists in the Register & Login add-on where the before email success msg() function whitelists the client-submitted role key and copies it into the user-data array passed to wp insert user(). The process fails to validate the submitted role against the administrator-configured register user role, lacks an allow-list, and does not perform a current user can() capability check. This allows unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published registration form using the register login action='register' action.

Recommendations Update Super Forms – Drag & Drop Form Builder to version 6.3.317 or later.