← Back to the live CVE advisory feed

CVE-2026-17609: Super Forms – Drag & Drop Form Builder

Severity

9.1 (CRITICAL)

Vendor

WEBREHAB

Affected versions

0 through 6.3.316

Patch status

Unknown

Published

2026-10-08T05:17:04.793

Modified

2026-10-08T05:17:04.793

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Treat internet-facing systems as higher priority.

Technical summary

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.

View the official NVD record for CVE-2026-17609

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.