Super Forms: Arbitrary file and directory deletion by authenticated users
Summary
Super Forms, a WordPress form builder plugin, up to and including version 6.3.316 lets users with Subscriber rights or higher recursively delete arbitrary files and directories on the server. The flaw combines a missing capability check in the form save handler with unsanitized input in the form submission handler, which passes an attacker-controlled path to a delete function. An attacker can delete critical files such as wp-config.php, which can take the whole site offline and may lead to remote code execution if the site is re-installed by someone else. The CVSS base score is 8.1 (High). The CVE record and CISA SSVC assessment state no known exploitation and not automatable.
Affected
- Super Forms (WebRehab) versions 0 to and including 6.3.316
- Default configuration: unaffected (vulnerable setting 'file_upload_submission_delete' must be enabled)
Fixed in
- Version 6.3.317 (stable line), according to a WPScan listing that matches this flaw; the mapping to this CVE is an inference
- Version 6.4.008 for the 6.4 beta line; the vendor recommends updating all sites on 6.4.001 to 6.4.007
- The vendor release notes for 6.3.317 do not name this CVE
Workaround
- No workaround is documented in the CVE record.
- VulDB advises restricting file upload permissions for lower-level user roles until updates are applied.
- Disable the 'Delete files from server after form submissions' setting until the update is installed.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Requires an authenticated account with at least Subscriber rights.
- No public exploitation has been confirmed in the sources reviewed.
Our recommendation
- Update Super Forms to version 6.3.317 or later (or 6.4.008 or later on the beta line) on every site.
- Until then, disable the file deletion-after-submission setting and restrict account registration and file upload permissions for lower-level roles.
- Review user accounts with Subscriber access and remove unneeded accounts.
- Check the WordPress installation and file integrity, and back up the site before and after updating.
- Monitor for unexpected missing files and for changes to wp-config.php.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence: CVE-2026-15983 www.wordfence.com
- GitHub pull request #205 (super-forms) github.com
- Super Forms 6.3.317 release notes github.com
- Super Forms 6.4.008 release notes github.com
- WPScan: Super Forms vulnerabilities wpscan.com
- OSV: CVE-2026-15983 osv.dev
- VulDB: CVE-2026-15983 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:04.
Original description (NVD)
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super Forms and enable the `file_upload_submission_delete` setting — combined with the `super_submit_form` handler's `submit_form` function passing the attacker-controlled `files[].subdir` value from `$_POST['data']` directly into `SUPER_Common::delete_dir()` without sanitization, and a trivially bypassed `ABSPATH` guard that a `subdir` value of `wp-config.php` defeats because `dirname(realpath(ABSPATH . $subdir))` resolves to the WordPress root while the naive `ABSPATH !== $dir` string check fails to match due to a trailing-slash mismatch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to recursively delete arbitrary files and directories on the server, up to and including the entire WordPress installation, resulting in full site takedown and potential remote code execution if critical files such as `wp-config.php` are removed and the site is subsequently re-installed by another party.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.