CVE-2026-15990

Name of the Vulnerable Software and Affected Versions Formidable Charts versions prior to 2.0.2

Description An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By manipulating the frm graph parameter, an attacker can read arbitrary files on the server, potentially exposing sensitive information. This requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active, and the wp-content/uploads/frm-charts/ directory must exist, which typically occurs after an image-format chart is rendered.

Recommendations Update to version 2.0.2 or later. Restrict access to the frm graph parameter to minimize the risk of exploitation.