← Vulnerability feed

Vulnerability record · CVE-2026-15896 · published 2 October 2026

CVE-2026-15896: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all ve…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

9.1 CVSS 3.1 Critical EPSS 0.88% · top 42.2% CWE-26 · CWE-26 Deferred
9.1CVSS 3.1 base score
0.88%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
2References
2 Oct 2026Last modified by NVD

Description

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

LinkTags
https://github.com/RensTillmann/super-forms/pull/205
https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3df045-1020-403f-8e10-a1b75261b769?source=cve

Track CVE-2026-15896 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-102490Zammad improper privilege management vulnerabilityAll versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.KEVEPSS 0.26%9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed7.4CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.4%analysed9.8CVE-2026-46817Oracle E-Business Suite Payments missing authentication allows takeoverOracle Payments in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an easily exploitable flaw in the File Transmission component. An unauthen…KEVEPSS 0.81%analysed10.0CVE-2026-48172LiteSpeed cPanel Plugin Redis Feature Privilege EscalationThe LiteSpeed User-End cPanel Plugin before 2.4.5 mishandles Redis enable/disable functionality, allowing privilege escalation that may reach root. I…KEVEPSS 1.0%analysed7.8CVE-2026-21533Windows Remote Desktop improper privilege management allows local elevationWindows Remote Desktop contains an improper privilege management flaw (CWE-269) that lets an authorized attacker elevate privileges locally. It affec…KEVEPSS 4.1%analysed7.8CVE-2025-41244VMware Aria Operations and Tools local privilege escalation to rootVMware Aria Operations and VMware Tools contain a local privilege escalation flaw where a non-administrative local actor on a VM with VMware Tools in…KEVEPSS 8.4%analysed5.1CVE-2024-8068Citrix Session Recording privilege escalation to NetworkServiceCitrix Session Recording contains an improper privilege management flaw (CWE-269) that lets an authenticated attacker escalate to the NetworkService …KEVEPSS 3.5%analysed

Source: NIST National Vulnerability Database (record CVE-2026-15896), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.