Arbitrary file upload in Webrehab Super Forms – Drag & Drop Form Builder
CVE-2026-17609
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.
Vulnerability class: Unrestricted File Upload
Published .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-17609?
- CVE-2026-17609 is a critical-severity vulnerability in Webrehab Super Forms – Drag & Drop Form Builder, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.1/10. Published 2026-10-08.
- How severe is CVE-2026-17609?
- Critical severity. CVSS v3 base score is 9.1 out of 10.