Skip to content
Threat Feed
Subscribe

Product

Super Forms – Drag & Drop Form Builder (<= 6.3.316)

2 briefs RSS
high advisory

Arbitrary Directory Deletion in Super Forms WordPress Plugin

Unauthenticated attackers can achieve arbitrary recursive directory deletion in Super Forms versions 6.3.316 and earlier by exploiting improper path validation in the submit_form function.

Super Forms – Drag & Drop Form Builder wordpress vulnerability remote-deletion web-application
1t 1c
critical advisory

Unauthenticated Privilege Escalation in Super Forms WordPress Plugin

An unauthenticated privilege escalation vulnerability (CVE-2026-15989) in the Super Forms WordPress plugin allows attackers to register administrative accounts via registration form injection.

PoC Super Forms – Drag & Drop Form Builder web-application wordpress privilege-escalation cve-2026-15989
1r 1t 1c updated