← Back to search

CVE-2026-15896

9.1 CRITICALpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI risk analysis

Summary
The Super Forms – Drag & Drop Form Builder plugin for WordPress allows unauthenticated attackers to read server files via directory traversal, posing a critical security risk.
Exploitability
Exploitation is relatively easy due to the lack of authentication requirements and the presence of a 13-digit timestamp directory on Linux, or any hardcoded prefix on Windows.
Blast radius
If exploited, attackers can access sensitive information stored on the server, leading to data breaches and potential further attacks.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to version 6.3.32 or later, as the vulnerability was fixed in this version.
directory-traversalunauthenticatedfile-readwordpress

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-26

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.