Super Forms vulnerabilities

The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316) is vulnerable to Privilege Escalation. The Register & Login add-on's before_email_success_msg() function in the register_login_action='update' flow trusts an attacker-supplied user_id value and passes it to wp_update_user() without any ownership or capability check. An authenticated attacker with Subscriber-level access can create a malicious form and submit it with an administrator's user_id and a new password/email, resulting in account takeover.

Unauthenticated arbitrary file download vulnerability in Super Forms versions up to 6.3.315.

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration.

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').