CVE-2026-15897 WebRehab CVE debrief

Who should care

Site administrators and security teams responsible for WordPress installations using the Super Forms – Drag & Drop Form Builder plugin should assess their exposure and take immediate action to update the plugin and restrict access to its settings and functionality.

Why it matters

The CVE-2026-15897 vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress allows authenticated attackers with Subscriber-level access and above to escalate their privileges, potentially leading to account takeover and full site compromise. Site administrators and security teams should assess their exposure and take immediate action to update the plugin and restrict access to its settings and functionality.

• Authenticated attackers with Subscriber-level access and above can overwrite the credentials of arbitrary existing accounts, including administrators, resulting in account takeover and full site compromise.
• The vulnerability allows for privilege escalation, enabling attackers to gain elevated access to sensitive areas of the site.
• The attack can be performed using a malicious form created by the attacker, which can be submitted with a user_id set to an administrator's ID and a new user_pass/user_email.

Technical summary

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation due to the Register & Login add-on's before_email_success_msg() function trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. This allows authenticated attackers with Subscriber-level access and above to overwrite the credentials of arbitrary existing accounts, including administrators, resulting in account takeover and full site compromise. The vulnerability is exploitable through a malicious form created by the attacker, which can be submitted with a user_id set to an administrator's ID and a new user_pass/user_email.

Defensive priority

High

Recommended defensive actions

• Update the Super Forms – Drag & Drop Form Builder plugin to a version that fixes the vulnerability
• Restrict access to the plugin's settings and functionality to authorized users only
• Monitor user account activity and changes for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references. The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation due to the Register & Login add-on's before_email_success_msg() function trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Evidence is limited to public CVE and NVD sources. Defenders should verify the vulnerability's existence and impact using

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.