Threats tagged 'ghsa-r39q-9952-j46j'

The Super Forms – Drag & Drop Form Builder WordPress plugin is affected by a critical directory traversal vulnerability (CVE-2026-15896) in all versions up to 6.3.316. This flaw allows unauthenticated attackers to read arbitrary files on the server via the parse_request function. By default, no authentication is required to exploit this, though enabling the optional 'file_upload_auth' setting can mitigate unauthenticated access but does not fix the underlying vulnerability. Exploitation conditions differ between Linux and Windows environments but are generally feasible when file upload is enabled.