CVE-2026-17609 Details
Description
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.
A vulnerability allowing arbitrary directory deletion has been identified in the Super Forms – Drag & Drop Form Builder plugin for WordPress, affecting all versions through 6.3.316. The issue arises in the submit_form function, where there is inadequate validation of attacker-controlled JSON field declarations against the actual form schema. This flaw, coupled with a weak ABSPATH guard that can be easily bypassed, enables unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires the 'Delete files from server after form submissions' setting to be enabled, a feature that is commonly used.
Users are advised to update the Super Forms WordPress plugin to version 6.3.317 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RensTillmann/super-forms/pull/205 | [email protected] | Issue TrackingSource CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/f21577b4-b7c6-4b39-b2b7-66a75c5f56fb?source=cve | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Super Forms | <= 6.3.316 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 10, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |