The Super Forms – Drag & Drop Form Builder plugin for WordPress contains a critical vulnerability (CVE-2026-17609) that allows unauthenticated attackers to recursively delete arbitrary directories on the server. This affects all versions up to and including 6.3.316. The issue arises from insufficient validation of attacker-controlled JSON fields and a bypassable ABSPATH guard, enabling directory deletion when the 'Delete files from server after form submissions' setting is enabled by an administrator.
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.
The Super Forms – Drag & Drop Form Builder WordPress plugin is affected by a critical directory traversal vulnerability (CVE-2026-15896) in all versions up to 6.3.316. This flaw allows unauthenticated attackers to read arbitrary files on the server via the parse_request function. By default, no authentication is required to exploit this, though enabling the optional 'file_upload_auth' setting can mitigate unauthenticated access but does not fix the underlying vulnerability. Exploitation conditions differ between Linux and Windows environments but are generally feasible when file upload is enabled.
The Super Forms – Drag & Drop Form Builder WordPress plugin contains a privilege escalation vulnerability in versions up to and including 6.3.316. This flaw allows authenticated users with Subscriber-level access or higher to overwrite credentials of arbitrary accounts, including administrators, by exploiting insufficient capability checks in the Register & Login add-on. Successful exploitation can lead to full site compromise.
The Super Forms – Drag & Drop Form Builder WordPress plugin is vulnerable to arbitrary file and directory deletion in all versions up to and including 6.3.316. This vulnerability allows authenticated users with Subscriber-level access or higher to delete files and directories on the server, including critical WordPress files such as wp-config.php. The flaw arises from insufficient capability checks and improper sanitization of user-controlled input in AJAX handlers, enabling recursive deletion that can lead to full site takedown and potential remote code execution if the site is reinstalled by an attacker.
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.