NVD HIGH: CVE-2026-15897 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to...
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Bec
CVE-2026-15897