CVE-2026-15990: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Strategy11 Formidable Charts

CVE-2026-15990 is a directory traversal vulnerability (CWE-22) in the Formidable Charts WordPress plugin. It affects all versions up to and including 2.0.1. The vulnerability is exploitable via the 'frm_graph' parameter, enabling unauthenticated attackers to read arbitrary files on the server. Exploitation requires that Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts plugins are active and that the wp-content/uploads/frm-charts/ directory exists, typically after rendering an image-format chart. This can lead to disclosure of sensitive information stored on the server.

An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information. The vulnerability does not allow modification or deletion of data, nor does it affect availability. The impact is confidentiality loss with a high severity rating (CVSS 7.5).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the Formidable Charts plugin or restricting access to the wp-content/uploads/frm-charts/ directory to trusted users only. Monitor official Strategy11 communications for updates and patches.