Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains a privilege escalation caused by lack of ownership and capability checks in Register & Login add-on's before_email_success_msg() and super_save_form AJAX action, letting authenticated users with Subscriber-level access overwrite credentials of arbitrary accounts including administrators, exploit requires authenticated user with Subscriber-level access or higher.
Update to the latest version beyond 6.3.316.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.
