Super Forms CVE-2026-15897

Requires an authenticated account at Subscriber level or above on the target site (PR:L), which is readily obtainable wherever open user registration is enabled - a common WordPress configuration. The attacker must be able to reach the super_save_form AJAX endpoint to create a form using the Register & Login add-on configured with register_login_action='update' and register_login_user_id_update='true', meaning the Register & Login add-on must be active. Exploitation works against default configurations of affected versions (≤6.3.316) with no user interaction and no non-default server settings; the primary limiting factors are the need for a low-privileged account and for the Register & Login add-on to be in use.

This is a genuinely high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) is internally consistent with the description: exploitation is remote, requires only low privileges (any Subscriber-level account, which is self-registration on many WordPress sites), needs no user interaction, and has low attack complexity because the attacker fully controls the malicious form and the user_id value. The C:H/I:H/A:H impact is justified - overwriting an administrator's credentials yields complete account takeover and full site compromise. Two missing capability checks (both the super_save_form AJAX action and the before_email_success_msg() update flow) compound into a reliable primitive, lowering complexity further. On the demand side, no EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the GitHub reference is a vendor fix pull request, not weaponized code. The net picture: a mechanically simple, low-barrier privilege-escalation bug in a sellable WordPress plugin - high intrinsic risk that should be patched urgently even though current exploitation-probability signals (EPSS/KEV/POC) are absent from the data.

An attacker registers or already holds a Subscriber-level account on a WordPress site running Super Forms. Using the unprotected super_save_form AJAX action they create a form with register_login_action='update' and register_login_user_id_update='true', then submit it with user_id set to the administrator's ID (typically 1) plus an attacker-chosen user_pass and user_email, overwriting the admin's credentials and taking over the site. No public exploit is identified at time of analysis, but the attack is trivial given low complexity and no required user interaction.