CVE-2026-15990 Directory Traversal in Formidable Charts Plugin

The Formidable Charts plugin for WordPress (versions 2.0.1 and below) contains a directory traversal vulnerability. An unauthenticated attacker can exploit this flaw by manipulating the 'frm_graph' parameter in HTTP requests. Successful exploitation allows for the reading of arbitrary files from the server filesystem, which may lead to the disclosure of sensitive configuration files, credentials, or application data.

The vulnerability is conditional: it requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active on the target site. Furthermore, the directory 'wp-content/uploads/frm-charts/' must exist, which typically occurs after the application renders an image-format chart. This vulnerability poses a significant risk to the confidentiality of the web server, particularly in environments hosting sensitive data or configuration files in the web root or accessible directories.

Impact

Successful exploitation results in unauthorized access to arbitrary files on the host server. Depending on the target environment, this could lead to the exfiltration of sensitive information, such as wp-config.php files containing database credentials, API keys, or other environmental configuration data. This could facilitate further exploitation, privilege escalation, or full site takeover.

Recommendation

• Update the Formidable Charts plugin to the latest version immediately to remediate CVE-2026-15990.
• Monitor web access logs for suspicious patterns in the 'frm_graph' parameter, specifically looking for sequences indicative of path traversal (e.g., '../', '..%2f').
• Restrict web server permissions to ensure that the WordPress application user has only the minimum necessary read access to the filesystem.
• Deploy a web application firewall (WAF) rule to inspect and block requests containing traversal sequences targeting the WordPress uploads directory.