← Back to search

CVE-2026-17196

8.8 HIGHpublic exploit available

Published 2026-10-08 · Updated 2026-10-08

AI risk analysis

Summary
The flaw allows authenticated attackers to upload executable files, leading to remote code execution, due to missing file type validation.
Exploitability
Exploitation requires first poisoning the _super_elements post meta via the super_save_form AJAX handler, followed by an unauthenticated file upload. The attack is moderately complex due to the need for initial authentication and the specific handling of the super_save_form endpoint.
Blast radius
If exploited, the vulnerability could lead to full control of the affected WordPress site, including remote code execution and potential data exfiltration.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Disable the Super Forms – Drag & Drop Form Builder plugin until a patch is available, or upgrade to version 6.3.317 or later.
rcewebwp-pluginauth-bypass

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.