CVE-2026-15896
CriticalCVSS 9.1Summary
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration.
Risk Assessment
An attacker can read sensitive files such as configurations, credentials, or user data. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix.
Recommendation
It is recommended to update the plugin to the latest version and enable the 'file_upload_auth' setting to mitigate the risk.
Other vulnerabilities in Super Forms
See all- CVE-2026-15897High
The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316) is vulnerable to Privilege Escalation. The Register & Login add-on's before_email_success_msg() function in the register_login_action='update' flow trusts an attacker-supplied user_id value and passes it to wp_update_user() without any ownership or capability check. An authenticated attacker with Subscriber-level access can create a malicious form and submit it with an administrator's user_id and a new password/email, resulting in account takeover.
- CVE-2026-28167High
Unauthenticated arbitrary file download vulnerability in Super Forms versions up to 6.3.315.
- CVE-2026-15989Critical
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').
Original NVD description (English source)
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS