IT SBIT Services
Schneeberger
DEEN
CVE tracker

Super Forms WordPress plugin: Unauthenticated directory traversal leading to arbitrary file read

CVE-2026-15896Critical 9.1

← All vulnerabilities

Summary

Super Forms, a WordPress form builder plugin, contains a directory traversal flaw in its parse_request function. An unauthenticated remote attacker can read arbitrary files on the server, which may contain sensitive information such as configuration data. In the default configuration no authentication is required, and the flaw remains exploitable while file upload is enabled on a form, because the upload response reveals the created directory name.

Affected

  • Super Forms – Drag & Drop Form Builder (WordPress plugin) up to and including 6.3.316
  • Default configuration: unauthenticated exploitation possible

Fixed in

  • Unknown for this CVE. The vendor's fix candidate is GitHub PR #205 (merged into lts/6.3.x), but it does not name this CVE.
  • Vendor notes mention 6.3.317 and 6.3.320 for the 6.3 line; this conflicts and is not confirmed for CVE-2026-15896.

Workaround

  • Enable the file_upload_auth setting: this blocks unauthenticated exploitation but does not fix the traversal itself.
  • Disable file upload on forms that do not need it.
  • Optional stopgap, not vendor-tested: WAF rule for '../' sequences in requests to plugin endpoints.

Exploitation

  • CISA SSVC (Vulnrichment): exploitation none, automatable yes, technical impact partial.
  • No confirmed exploitation in the wild found for this CVE; not listed in KEV according to one source.
  • No public proof of concept found; this does not prove none exists.
  • Related CVE-2026-14894 in the same plugin is reported as actively exploited (secondary source, unverified).

Our recommendation

  • Update Super Forms to the newest 6.3.x release and check the vendor changelog explicitly for CVE-2026-15896; do not rely on a version number until confirmed.
  • Until patched, enable file_upload_auth and disable file upload on forms that do not need it.
  • Inventory WordPress sites running Super Forms at or below 6.3.316 and prioritise internet-facing sites.
  • If a vulnerable version was internet-exposed, check for web shells, unexpected admin accounts and unexpected options, and rotate credentials, especially database credentials.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:38.

Original description (NVD)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed