CVE-2026-17196: CWE-434 Unrestricted Upload of File with Dangerous Type in WebRehab Super Forms – Drag & Drop Form Builder

CVE-2026-17196 describes an unrestricted file upload vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress versions up to and including 6.3.316. The vulnerability arises because the upload_files function does not validate file types properly, relying on an attacker-controlled extensions string from the _super_elements post meta. An attacker with at least Subscriber-level authentication can poison this post meta via the super_save_form AJAX handler, which lacks capability and nonce checks. After this, the attacker can upload files without authentication via super_upload_files, potentially leading to remote code execution.

An attacker with Subscriber-level access can bypass file type restrictions and upload executable files, leading to remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system.

No explicit patch or remediation is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level user capabilities and monitor for suspicious uploads related to the Super Forms plugin.