IT SBIT Services
Schneeberger
DEEN
CVE tracker

Super Forms WordPress plugin: Unrestricted file upload leading to possible remote code execution

CVE-2026-17196High 8.8

← All vulnerabilities

Summary

The Super Forms – Drag & Drop Form Builder plugin for WordPress up to and including 6.3.316 does not validate file types in its upload function. The allowed extensions are read from an attacker-controlled form setting, so an attacker can upload executable files. The attacker needs at least a Subscriber account; the official record is inconsistent on whether the follow-up upload step requires authentication. A successful upload can lead to remote code execution on the web server.

Affected

  • Super Forms – Drag & Drop Form Builder (WordPress plugin) up to and including 6.3.316
  • Stable line of the plugin; the vendor release notes also reference the 6.4 line

Fixed in

  • Version 6.3.317 or later (per vendor release notes; not independently verified)
  • Sites on the 6.3 line should use the current 6.3.x release (6.3.320 per vendor notes, not independently verified)

Workaround

  • No vendor workaround found.
  • Restrict or disable public user registration.
  • Remove unneeded Subscriber accounts.
  • Review the uploads directory for unexpected executable files.

Exploitation

  • No confirmed in-the-wild exploitation found for this CVE.
  • No public exploit available at the time of research.
  • Not listed in CISA KEV; EPSS about 0.5% at the time of listing.
  • Other Super Forms flaws are being actively exploited; those are separate CVEs.

Our recommendation

  • Identify all WordPress sites with Super Forms and confirm the installed version.
  • Update to version 6.3.317 or later, or the current release on your branch.
  • Check whether public registration or the Register & Login add-on is enabled, and disable it if not needed.
  • Review recent uploads for executable files and remove any unexpected ones.
  • Monitor web server logs for unusual upload requests.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:14.

Original description (NVD)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed