CVE-2026-15897

🗓️ 02 Oct 2026 05:30:17Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 33 Views🌐 WEB

Privilege Escalation in Super Forms – Drag & Drop Form Builder via before_email_success_msg().

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-15897	2 Oct 202607:03	–	circl
Cvelist	CVE-2026-15897 Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login	2 Oct 202605:30	–	cvelist
EUVD	EUVD-2026-91176	2 Oct 202605:30	–	euvd
NVD	CVE-2026-15897	2 Oct 202606:16	–	nvd
osv_cve	CVE-2026-15897 Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login	2 Oct 202605:30	–	osv_cve
Patchstack	WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation vulnerability	1 Oct 202617:08	–	patchstack
Positive Technologies	PT-2026-104078	2 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-15897: Improper Privilege Management	2 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-15897 Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login	2 Oct 202605:30	–	vulnrichment

Vulners

Node

super-forms super_formsRange≤6.3.316wordpress

[
  {
    "vendor": "WebRehab",
    "product": "Super Forms – Drag & Drop Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.3.316",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/RensTillmann/super-forms/pull/205
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/94297481-9ebb-42cb-9362-be8bc52b126f

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	The super_save_form AJAX action fails to perform capability checks, allowing authenticated users to submit a request that updates arbitrary user accounts (including administrators) by providing a target user_id.	CWE-269
register_login_action	request body	/wp-admin/admin-ajax.php	The super_save_form AJAX action fails to perform capability checks, allowing authenticated users to submit a request that updates arbitrary user accounts (including administrators) by providing a target user_id.	CWE-269
register_login_user_id_update	request body	/wp-admin/admin-ajax.php	The super_save_form AJAX action fails to perform capability checks, allowing authenticated users to submit a request that updates arbitrary user accounts (including administrators) by providing a target user_id.	CWE-269
user_id	request body	/wp-admin/admin-ajax.php	The super_save_form AJAX action fails to perform capability checks, allowing authenticated users to submit a request that updates arbitrary user accounts (including administrators) by providing a target user_id.	CWE-269
user_pass	request body	/wp-admin/admin-ajax.php	The super_save_form AJAX action fails to perform capability checks, allowing authenticated users to submit a request that updates arbitrary user accounts (including administrators) by providing a target user_id.	CWE-269
user_email	request body	/wp-admin/admin-ajax.php	The super_save_form AJAX action fails to perform capability checks, allowing authenticated users to submit a request that updates arbitrary user accounts (including administrators) by providing a target user_id.	CWE-269

03 Oct 2026 16:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.8

EPSS0.00294

SSVC

CWE-269