Arbitrary Directory Deletion in Super Forms WordPress Plugin

The Super Forms - Drag & Drop Form Builder plugin for WordPress (versions <= 6.3.316) is vulnerable to an arbitrary directory deletion vulnerability. The flaw exists within the submit_form function, where insufficient validation of JSON field declarations allows for path manipulation. Attackers can bypass the ABSPATH security guard by using the dirname() function to strip trailing slashes, effectively traversing the filesystem. If an administrator has enabled the 'Delete files from server after form submissions' setting, an unauthenticated attacker can recursively delete arbitrary directories, including the entire WordPress installation. This vulnerability poses a severe risk to service availability and data integrity for any WordPress site utilizing this plugin with the specific administrative setting enabled.

Attack Chain

1. Attacker identifies a WordPress installation running a vulnerable version of the Super Forms plugin (<= 6.3.316).
2. Attacker verifies the plugin's 'Delete files from server after form submissions' setting is active, commonly found in plugin configurations.
3. Attacker crafts a malicious JSON payload targeting the submit_form function.
4. Attacker includes a directory path string designed to bypass the ABSPATH security guard via dirname() behavior.
5. Attacker sends an HTTP POST request to the plugin's submission endpoint containing the crafted JSON.
6. The application parses the malicious JSON and fails to validate the directory path against the intended schema.
7. The application executes the recursive deletion command on the provided target path.
8. Final objective is achieved as the target directory (e.g., WordPress root) is deleted from the server.

Impact

Successful exploitation results in the recursive deletion of arbitrary directories on the host server. If the WordPress root directory is targeted, it results in complete application destruction and permanent data loss for the affected site. As the plugin is a popular form builder, numerous WordPress deployments globally are potentially at risk.

Recommendation

Prioritized actions for security teams:

• Immediately upgrade the Super Forms plugin to the latest available patched version.
• Disable the 'Delete files from server after form submissions' feature in the Super Forms configuration if an immediate update is not possible.
• Audit existing form submissions and plugin logs for any unexpected HTTP POST requests directed at the submit_form endpoint that contain directory traversal patterns (e.g., '../').
• Ensure regular off-site backups are maintained to recover from potential data destruction events.