What is CVE-2026-15990?

CVE-2026-15990 is a high-severity vulnerability in Strategy11 Formidable Charts, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-08-26.

How severe is CVE-2026-15990?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Strategy11 Formidable Charts

CVE-2026-15990

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered.

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Strategy11 Formidable Charts

Weakness classification (CWE)

CWE-22 — Path Traversal

References

Frequently asked questions

What is CVE-2026-15990?: CVE-2026-15990 is a high-severity vulnerability in Strategy11 Formidable Charts, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-08-26.
How severe is CVE-2026-15990?: High severity. CVSS v3 base score is 7.5 out of 10.