{"id":"CVE-2026-15983","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-15983","generatedAt":"2026-10-28T00:57:04.650Z","title":"The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316.","description":"The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super Forms and enable the `file_upload_submission_delete` setting — combined with the `super_submit_form` handler's `submit_form` function passing the attacker-controlled `files[].subdir` value from `$_POST['data']` directly into `SUPER_Common::delete_dir()` without sanitization, and a trivially bypassed `ABSPATH` guard that a `subdir` value of `wp-config.php` defeats because `dirname(realpath(ABSPATH . $subdir))` resolves to the WordPress root while the naive `ABSPATH !== $dir` string check fails to match due to a trailing-slash mismatch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to recursively delete arbitrary files and directories on the server, up to and including the entire WordPress installation, resulting in full site takedown and potential remote code execution if critical files such as `wp-config.php` are removed and the site is subsequently re-installed by another party.","published":"2026-10-01T09:17:09.000Z","lastModified":"2026-10-03T16:16:36.000Z","status":"Deferred","sourceIdentifier":"security@wordfence.com","cvss":{"version":"3.1","score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},"cwe":["CWE-73"],"affected":[],"epss":{"score":0.00522,"percentile":0.44037,"date":"2026-10-26","history":[{"date":"2026-10-02","score":0.00538,"percentile":0.43253}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-01T09:17:09.000Z","detail":{"score":"8.1","severity":"HIGH","publishedAt":"2026-10-01T09:17:09.223Z"},"summary":"New CVE, high severity (CVSS 8.1)."}],"references":[{"url":"https://github.com/RensTillmann/super-forms/pull/205","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25704473-1200-49df-aa16-9a9558bb4844?source=cve","source":"security@wordfence.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-15983","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}