CVE-2026-17609

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317

Description An issue exists in the submit form() function that allows unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. This occurs because of insufficient validation of attacker-controlled JSON field declarations against the actual form schema and a non-effective ABSPATH guard that is bypassed when dirname() strips the trailing slash. This flaw is exploitable when the 'Delete files from server after form submissions' setting is enabled by an administrator.

Recommendations Update to version 6.3.317 or later. Disable the 'Delete files from server after form submissions' setting as a temporary mitigation measure.