Webrehab Super Forms Drag Drop Form Builder vulnerabilities

CVE-2026-14894 [CRITICAL] CWE-434 CVE-2026-14894: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Uplo The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely o

CVE-2026-15989 [CRITICAL] CWE-269 CVE-2026-15989: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_inse

CVE-2026-15896 [CRITICAL] CWE-26 CVE-2026-15896: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upl

CVE-2026-17196 [HIGH] CWE-434 CVE-2026-17196: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File T The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post

CVE-2026-17609 [CRITICAL] CWE-434 CVE-2026-17609: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard t

CVE-2026-15897 [HIGH] CWE-269 CVE-2026-15897: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user()

CVE-2026-15983 [HIGH] CWE-73 CVE-2026-15983: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Dire The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super Forms and enable the `file_upload_sub