WordPress Form Plugin Allows Unauthorized Admin Role Assignment

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Super Forms – Drag & Drop Form Builder plugin for WordPress contains a critical privilege escalation vulnerability in its Register & Login add-on that allows attackers to assign themselves administrator roles during user registration. The vulnerable before_email_success_msg() function accepts user-submitted role parameters without validation, directly passing them to WordPress's wp_insert_user() function. This bypasses the plugin's intended role restrictions entirely, affecting all versions up to 6.3.316. Any unauthenticated attacker can exploit this during the registration process to gain full administrative access to WordPress installations using this plugin, making it a severe threat to website integrity and data security.

Casky's 224 mapped security skills aligned with MITRE ATT&CK technique TA0004 (Privilege Escalation) enable detection of this vulnerability's attack patterns through Claude AI's extended reasoning capabilities. Practitioners using Casky would identify indicators including: input validation bypass patterns where client-submitted parameters flow directly into privileged functions without sanitization; role assignment anomalies showing unexpected administrator accounts created through registration forms; and unsafe parameter handling in user creation workflows. The platform's skill mapping would highlight CWE-269 (Improper Access Control) violations, correlating suspicious role-assignment requests with MITRE ATT&CK patterns for privilege escalation. Security teams would see findings flagging the absence of role allow-lists, direct user input trust in administrative functions, and post-registration account permission spikes—enabling proactive detection before attackers establish persistent admin access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15989.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15989

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15989. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn