Super Forms: Arbitrary directory deletion via form submission
Summary
Super Forms, a form builder plugin for WordPress, allows unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. The flaw is in the public form submission handler, which does not validate attacker-controlled file field declarations against the form schema. Exploitation requires that an administrator has enabled the setting 'Delete files from server after form submissions'.
Affected
- Super Forms (WordPress plugin) up to and including 6.3.316
- Other versions are not listed as affected by the CNA
Fixed in
- Stable line 6.3: version 6.3.317 or later
- Beta line 6.4: version 6.4.008 or later (fix stated in the vendor release notes)
- Check the vendor site for the current stable release and install it
Workaround
- No vendor workaround documented.
- Disabling 'Delete files from server after form submissions' removes the stated precondition. This is an inference from the description and should be tested first.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No known in-the-wild exploitation found in the sources.
- Public proof of concept: unknown.
Our recommendation
- Check whether Super Forms up to 6.3.316 is installed on any public WordPress site.
- Update to the current stable release and verify that the update was applied.
- Review and, if not needed, disable the setting 'Delete files from server after form submissions'.
- Confirm that backups exist and can be restored, including the WordPress files and database.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence advisory www.wordfence.com
- GitHub pull request #205 (super-forms) github.com
- Super Forms release v6.4.008 github.com
- WPScan plugin page: Super Forms wpscan.com
- OSV vulnerability record CVE-2026-17609 osv.dev
- HOL security advisory CVE-2026-17609 hol.org
- Vendor documentation: Super Forms docs.super-forms.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:15.
Original description (NVD)
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.