Threats tagged 'ghsa-pchj-gc42-gqq7'

The Super Forms – Drag & Drop Form Builder plugin for WordPress contains a critical vulnerability (CVE-2026-17609) that allows unauthenticated attackers to recursively delete arbitrary directories on the server. This affects all versions up to and including 6.3.316. The issue arises from insufficient validation of attacker-controlled JSON fields and a bypassable ABSPATH guard, enabling directory deletion when the 'Delete files from server after form submissions' setting is enabled by an administrator.