CVE-2026-17609: CWE-434 Unrestricted Upload of File with Dangerous Type in WebRehab Super Forms – Drag & Drop Form Builder

CVE-2026-17609 is a critical vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin (versions <=6.3.316). The vulnerability is due to insufficient validation of attacker-controlled JSON field declarations against the form schema combined with a non-effective ABSPATH guard that can be bypassed using dirname() stripping the trailing slash. This flaw enables unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory, via the submit_form function. Exploitation depends on the 'Delete files from server after form submissions' feature being enabled by an administrator.

Successful exploitation results in arbitrary directory deletion on the server, which can lead to denial of service by removing critical files, including the WordPress root directory. The vulnerability does not directly impact confidentiality but has a high impact on integrity and availability.

No official patch or fix information is provided in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the 'Delete files from server after form submissions' setting to prevent exploitation.