Vulnerability in Super Forms – Drag & Drop Form Builder (WordPress plugin) (CVE-2026-15983)
Summary
Vulnerability in Super Forms – Drag & Drop Form Builder (WordPress plugin) (CVE-2026-15983). Data can be tampered with by attackers. Exploitable via super_save_form.
Original description
The description as published by the source.
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the super_save_form AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super Forms and enable the file_upload_submission_delete setting — combined with the super_submit_form handler's submit_form function passing the attacker-controlled files[].subdir value from $_POST['data'] directly into SUPER_Common::delete_dir() without sanitization, and a trivially bypassed ABSPATH guard that a subdir value of wp-config.php defeats because dirname(realpath(ABSPATH . $subdir)) resolves to the WordPress root while the naive ABSPATH !== $dir string check fails to match due to a trailing-slash mismatch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to recursively delete arbitrary files and directories on the server, up to and including the entire WordPress installation, resulting in full site takedown and potential remote code execution if critical files such as wp-config.php are removed and the site is subsequently re-installed by another party.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-15983 has been found in Super Forms – Drag & Drop Form Builder (WordPress plugin).
Attackers can target a specific entry point like super_save_form over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 8.1/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Super Forms – Drag & Drop Form Builder (WordPress plugin) CVE-2026-15983" on the vendor's site.
CVE-2026-15983 (Super Forms – Drag & Drop Form Builder (WordPress plugin)) — CWE-73 / CVSS v3 8.1
Attack vector: remote (network-reachable) / no user interaction
Attack surface: super_save_form / file_upload_submission_delete / super_submit_form / submit_form
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-73) exists in Super Forms – Drag & Drop Form Builder (WordPress plugin). Attackers reach the vulnerable code path via super_save_form.
Check the vendor advisory for the affected versions of Super Forms – Drag & Drop Form Builder (WordPress plugin). Attack surface: super_save_form / file_upload_submission_delete / super_submit_form / submit_form.
Severity: High (CVSS 8.1/10). Data can be tampered with by attackers.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで Super Forms – Drag & Drop Form Builder (WordPress plugin) を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- web github.com
- web wordfence.com
- web nvd.nist.gov
- web github.com