CVE-2026-17196 Details
Description
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.
A vulnerability exists in the Super Forms – Drag & Drop Form Builder plugin for WordPress, in all versions through 6.3.316. The issue allows for unrestricted file type uploads via the upload_files function, which fails to properly validate file types. This vulnerability arises because the upload_files function applies an attacker-controlled string from the _super_elements post meta as the allowed MIME type map, without any validation. As a result, authenticated attackers with Subscriber-level access or higher can upload potentially executable files, leading to remote code execution. Exploitation requires first manipulating the _super_elements post meta through the super_save_form AJAX handler, which does not check capabilities or nonces but requires at least Subscriber-level authentication. The actual file upload via super_upload_files does not require any authentication.
Users are advised to update the Super Forms – Drag & Drop Form Builder plugin to version 6.3.317 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RensTillmann/super-forms/pull/205 | [email protected] | Issue TrackingVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/63db136b-58da-4758-a506-4dc79b3c177d?source=cve | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Super Forms | <= 6.3.316 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |