CVE-2026-17196

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317

Description The plugin allows unrestricted file type upload through the upload files() function. This occurs because the function fails to validate file types, instead using an attacker-controlled extensions string from the super elements post meta as the allowed MIME type map. An authenticated attacker with Subscriber-level access or higher can poison the super elements post meta using the super save form AJAX handler, which lacks capability and nonce checks. Once the meta is poisoned, any user can upload executable files via super upload files without authentication, potentially leading to remote code execution.

Recommendations Update Super Forms – Drag & Drop Form Builder to a version newer than 6.3.316. As a temporary mitigation, restrict access to the super save form AJAX handler and the super upload files function.