Super Forms CVE-2026-15989

Exploitation requires the target site to have the Super Forms Register & Login add-on active and at least one published registration form configured with register_login_action='register'. Given that, there are no further barriers: no authentication, no user interaction, and no non-default server configuration is needed - the attacker simply injects role=administrator into the form submission. The limiting factor is therefore the presence of a live public registration form rather than any privilege or interaction requirement; sites using Super Forms only for contact/other forms (without the registration action) are not exposed.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is fully supported by the description: an unauthenticated remote attacker can inject role=administrator into any published Super Forms registration form, creating an Administrator account. The mechanism (whitelisting a client-submitted 'role' key straight into wp_insert_user() with no allow-list and no current_user_can() check) is a textbook mass-assignment privilege escalation and is trivially automatable, consistent with the low attack complexity. No EPSS score, CISA KEV entry, or public exploit code was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - however, the simplicity of the bug and the public GitHub patch (PR #205) disclosing the fixed code path significantly lower the bar for weaponization. No signals conflict here: the network vector, lack of authentication, and full CIA impact are all internally consistent. The only genuine limiting factor (not reflected in the raw 9.8) is that a site must have the Register & Login add-on active with a published registration form (register_login_action='register').

An attacker locates a WordPress site running Super Forms with a public registration form (Register & Login add-on, register_login_action='register'). They submit the registration form while appending role=administrator to the posted data; the before_email_success_msg() function copies that role straight into wp_insert_user(), creating a new Administrator account. No public exploit code was identified in the input, but the attack is a simple scripted HTTP POST and requires no authentication or user interaction.