WordPress Form Plugin Allows Unauthorized User Account Takeover

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Because the super_save_form AJAX action also enforces no capability check, any authenticated user with Subscriber-level access and above can create the required malicious form (register_login_action='update' with register_login_user_id_update='true') and then submit it with user_id set to an administrator's ID along with a new user_pass/user_email. This makes it possible for authenticated attackers with Subscriber-level access and above to overwrite the credentials of arbitrary existing accounts — including administrators — resulting in account takeover and full site compromise.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Super Forms – Drag & Drop Form Builder plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 6.3.316. The vulnerability exists in the Register & Login add-on's before_email_success_msg() function, which fails to validate user ownership or check administrative capabilities when processing user update requests. An attacker with basic authenticated access can exploit the super_save_form AJAX action to modify any user account on the site, including administrative accounts, by supplying an arbitrary user_id parameter. This represents a complete authentication bypass and account takeover risk for WordPress installations using this plugin, affecting website administrators and their users across thousands of potentially affected sites.

Casky's AI-driven security analysis maps this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation), correlating 224 security skills that detect the attack patterns characteristic of this flaw. Practitioners using Casky would identify red flags including: missing capability checks in AJAX handlers, insufficient input validation on user identifiers, unprotected administrative functions callable by authenticated users, and improper trust boundaries between user roles. The platform's extended reasoning capability would highlight the attack chain—how an authenticated attacker moves from initial access to administrative compromise through a single AJAX call—and flag similar patterns across custom form builders and user management implementations. Security teams would receive specific findings about the register_login_action parameter handling, the absence of wp_verify_nonce() calls, and recommendations to implement proper ownership verification before executing wp_update_user() operations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15897.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15897

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15897. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn