Attack Chain

1. Attacker identifies a WordPress installation running a vulnerable version of the Super Forms plugin (<= 6.3.316).
2. Attacker verifies the plugin's 'Delete files from server after form submissions' setting is active, commonly found in plugin configurations.
3. Attacker crafts a malicious JSON payload targeting the submit_form function.
4. Attacker includes a directory path string designed to bypass the ABSPATH security guard via dirname() behavior.
5. Attacker sends an HTTP POST request to the plugin's submission endpoint containing the crafted JSON.
6. The application parses the malicious JSON and fails to validate the directory path against the intended schema.
7. The application executes the recursive deletion command on the provided target path.
8. Final objective is achieved as the target directory (e.g., WordPress root) is deleted from the server.

Impact

Successful exploitation results in the recursive deletion of arbitrary directories on the host server. If the WordPress root directory is targeted, it results in complete application destruction and permanent data loss for the affected site. As the plugin is a popular form builder, numerous WordPress deployments globally are potentially at risk.

Recommendation

Prioritized actions for security teams:

• Immediately upgrade the Super Forms plugin to the latest available patched version.
• Disable the 'Delete files from server after form submissions' feature in the Super Forms configuration if an immediate update is not possible.
• Audit existing form submissions and plugin logs for any unexpected HTTP POST requests directed at the submit_form endpoint that contain directory traversal patterns (e.g., '../').
• Ensure regular off-site backups are maintained to recover from potential data destruction events.

Because the input is not validated against administrative settings, lacks an allow-list, and performs no capability checks via current_user_can(), unauthenticated attackers can inject the parameter 'role=administrator' into any public Super Forms registration form. This allows the creation of unauthorized accounts with full administrative privileges, granting the attacker complete control over the compromised WordPress instance. Defenders should identify all WordPress installations using Super Forms and ensure they are upgraded to a version beyond 6.3.316 or disable the Register & Login add-on immediately.

Attack Chain

1. Attacker identifies a target WordPress site utilizing the Super Forms - Drag & Drop Form Builder plugin.
2. Attacker locates a public-facing registration form created with the Super Forms plugin.
3. Attacker initiates an HTTP POST request to the form handler, specifying register_login_action='register'.
4. Attacker injects the 'role=administrator' parameter into the registration form submission data.
5. The server-side before_email_success_msg() function in the Register & Login add-on accepts the malicious 'role' key without validation.
6. The system executes wp_insert_user() using the attacker-supplied role data.
7. A new user account is created with Administrator privileges.
8. Attacker authenticates with the newly created account to establish persistent administrative access.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative access to affected WordPress installations. This leads to complete site compromise, including the ability to execute arbitrary code (via theme or plugin file uploads), exfiltrate sensitive user data, install backdoors, or redirect site traffic. This vulnerability carries a CVSS v3.1 base score of 9.8.

Recommendation

1. Update the Super Forms - Drag & Drop Form Builder plugin to a version higher than 6.3.316 immediately.
2. If an update is unavailable, disable the Register & Login add-on to prevent exploitation of CVE-2026-15989.
3. Audit the user database for accounts with administrative privileges created unexpectedly after the publication of this advisory (October 1, 2026).
4. Deploy the provided webserver detection rule to monitor for suspicious registration attempts containing unexpected role parameters.