Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
high
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 6.3.316
- Fixed in:
- 6.3.317
- Disclosed:
- Oct 7, 2026
CVE-2026-17196 on NVD →
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
critical
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a...
- CVSS:
- 9.1
(Wordfence)
- Affected:
- up to 6.3.316
- Fixed in:
- 6.3.317
- Disclosed:
- Oct 7, 2026
CVE-2026-17609 on NVD →
Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
high
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value a...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 6.3.316
- Fixed in:
- 6.3.317
- Disclosed:
- Oct 1, 2026
CVE-2026-15897 on NVD →
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
critical
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive infor...
- CVSS:
- 9.1
(Wordfence)
- Affected:
- up to 6.3.316
- Fixed in:
- 6.3.317
- Disclosed:
- Oct 1, 2026
CVE-2026-15896 on NVD →
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
high
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super For...
- CVSS:
- 8.1
(Wordfence)
- Affected:
- up to 6.3.316
- Fixed in:
- 6.3.317
- Disclosed:
- Sep 30, 2026
CVE-2026-15983 on NVD →
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
critical
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 6.3.316
- Fixed in:
- 6.3.317
- Disclosed:
- Sep 30, 2026
CVE-2026-15989 on NVD →
Super Forms – Drag & Drop Form Builder <= 6.3.315 - Unauthenticated Arbitrary File Read
high
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.3.315. This is due to insufficient validation of a user supplied path. This makes it possible for unauthenticated attackers to read arbitrary files on the server, including sensit...
- CVSS:
- 7.5
(Wordfence)
- Affected:
- up to 6.3.315
- Fix:
- No patched version reported
- Disclosed:
- Aug 24, 2026
CVE-2026-28167 on NVD →
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
critical
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrie...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 6.3.313
- Fixed in:
- 6.3.314
- Disclosed:
- Jul 9, 2026
CVE-2026-14894 on NVD →
Super Forms - Drag & Drop Form Builder WordPress <= 6.0.3 - Reflected Cross-Site Scripting
medium
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the
'bob_czy_panstwa_sprawa_zostala_rozwiazana' parameter in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
- CVSS:
- 6.1
(Wordfence)
- Affected:
- up to 6.0.3
- Fixed in:
- 6.0.4
- Disclosed:
- Jan 21, 2022
CVE-2022-0402 on NVD →
Super Forms – Drag & Drop Form Builder <= 4.9.700 - Arbitrary File Upload
critical
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the super-forms/uploads/php/directory in versions up to, and including, 4.9.702. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected s...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 4.9.700
- Fixed in:
- 4.9.800
- Disclosed:
- Jan 28, 2021
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database