CVE-2026-15983 affects the Super Forms – Drag & Drop Form Builder plugin for WordPress, versions up to and including 6.3.316. The vulnerability is due to missing capability checks in the 'super_save_form' AJAX handler, allowing Subscriber-level users to modify forms and enable the 'file_upload_submission_delete' setting. The 'super_submit_form' handler's 'submit_form' function then uses an attacker-controlled 'files[].subdir' POST parameter directly in the SUPER_Common::delete_dir() function without sanitization. A naive check intended to prevent deletion outside the WordPress root directory is bypassed due to a trailing slash mismatch, allowing deletion of arbitrary files and directories, including critical files such as wp-config.php. This can lead to complete site takedown and potential remote code execution if the site is reinstalled by an attacker after deletion.

Authenticated users with Subscriber-level access or higher can exploit this vulnerability to recursively delete arbitrary files and directories on the server hosting the WordPress site. This includes critical files like wp-config.php, which can result in full site takedown. If the site is subsequently reinstalled by an attacker, this may lead to remote code execution. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity with high impact on integrity and availability.

No patch or official fix is currently provided in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access and higher to trusted users only, and consider disabling or removing the Super Forms plugin if possible. Monitor for updates from the vendor and apply official patches once released.