CVE-2026-15983

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317

Description Authenticated users with Subscriber-level access and above can recursively delete arbitrary files and directories on the server, potentially leading to a full site takedown or remote code execution. The issue occurs because the super save form AJAX handler lacks capability checks, allowing users to enable the file upload submission delete setting. Subsequently, the submit form() function within the super submit form handler passes the files[].subdir variable from the $ POST['data'] array directly into the SUPER Common::delete dir() function without proper sanitization. A flawed ABSPATH guard is bypassed when the subdir variable is set to wp-config.php, as the string comparison fails to account for trailing-slash mismatches.

Recommendations Update Super Forms – Drag & Drop Form Builder to version 6.3.317 or later.