CVE-2026-15989 is a privilege escalation vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress, affecting all versions up to 6.3.316. The issue stems from the before_email_success_msg() function in the Register & Login add-on, which improperly whitelists the client-submitted 'role' key and copies it into the user data passed to wp_insert_user() without validating it against the configured register_user_role or performing any capability checks. This flaw enables unauthenticated attackers to create accounts with the Administrator role by injecting 'role=administrator' into registration form data.

An unauthenticated attacker can exploit this vulnerability to create a new user account with administrator privileges, resulting in full control over the affected WordPress site. This includes the ability to modify site content, install malicious plugins, access sensitive data, and potentially compromise the entire hosting environment. The CVSS 3.1 score of 9.8 reflects the critical severity and ease of exploitation without authentication or user interaction.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable the Register & Login add-on to prevent exploitation. Monitor official WebRehab communications for updates and apply patches promptly once released.