CVE-2026-15983: Super Forms Path Traversal Vulnerability

CVE-2026-15983 Overview

CVE-2026-15983 is an arbitrary file and directory deletion vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress. The flaw affects all versions up to and including 6.3.316. Authenticated attackers with Subscriber-level access can recursively delete arbitrary files and directories on the server. The vulnerability stems from a missing capability check in the super_save_form AJAX handler and unsanitized input flowing into SUPER_Common::delete_dir(). Successful exploitation can remove the entire WordPress installation, including wp-config.php, enabling site takedown. If an attacker re-installs the site after wp-config.php deletion, remote code execution becomes possible. This issue is tracked under [CWE-73] External Control of File Name or Path.

Critical Impact

Subscriber-level accounts can recursively delete the entire WordPress installation, leading to full site takedown and potential remote code execution.

Affected Products

• Super Forms – Drag & Drop Form Builder plugin for WordPress
• All versions up to and including 6.3.316
• WordPress sites allowing Subscriber-level registration

Discovery Timeline

• 2026-10-01 - CVE-2026-15983 published to NVD
• 2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-15983

Vulnerability Analysis

The vulnerability chains two distinct weaknesses in the Super Forms plugin. The super_save_form AJAX handler performs no capability check. This allows any authenticated user, including Subscribers, to create or modify Super Forms and enable the file_upload_submission_delete setting. The second weakness lives in the super_submit_form handler's submit_form function, which passes the attacker-controlled files[].subdir value from $_POST['data'] directly into SUPER_Common::delete_dir() without sanitization.

Attackers can target the entire WordPress root by supplying wp-config.php as the subdir value. The result is recursive deletion of arbitrary files and directories under the web root.

Root Cause

Two defects combine to produce the issue. First, the super_save_form handler lacks a current_user_can() capability gate. Second, the ABSPATH guard intended to prevent directory escape is trivially bypassed. The guard calls dirname(realpath(ABSPATH . $subdir)), which resolves to the WordPress root. The subsequent ABSPATH !== $dir string comparison fails because of a trailing-slash mismatch between ABSPATH and the resolved path. The guard therefore permits deletion of the WordPress root itself.

Attack Vector

An authenticated attacker with Subscriber-level access sends a crafted request to the super_save_form AJAX endpoint to create a form with file_upload_submission_delete enabled. The attacker then submits that form through super_submit_form with a files[].subdir payload such as wp-config.php. The plugin invokes SUPER_Common::delete_dir() against the resolved path, deleting target files or directories. No user interaction is required beyond the attacker's own authenticated session.

Technical details are available in the Wordfence Vulnerability Report and the upstream fix in GitHub Pull Request #205.

Detection Methods for CVE-2026-15983

Indicators of Compromise

• POST requests to admin-ajax.php with action=super_save_form originating from Subscriber-level accounts.
• POST requests to admin-ajax.php with action=super_submit_form containing files[].subdir values referencing core WordPress files such as wp-config.php, wp-admin, or wp-includes.
• Unexpected deletion of files under the WordPress root, especially wp-config.php, plugin directories, or upload directories.
• WordPress sites unexpectedly entering the installation wizard state after deletion of wp-config.php.

Detection Strategies

• Monitor WordPress audit logs for Super Forms create or update operations by non-administrator accounts.
• Inspect web server access logs for POST payloads containing the subdir parameter with path traversal or core-file references.
• Alert on file integrity changes to WordPress core files, wp-config.php, and plugin directories.

Monitoring Recommendations

• Enable file integrity monitoring across the WordPress document root and track unexpected file removal events.
• Centralize WordPress and web server logs in a security data lake and correlate AJAX activity with filesystem events.
• Track new Subscriber registrations followed by activity against admin-ajax.php within short time windows.

How to Mitigate CVE-2026-15983

Immediate Actions Required

• Update the Super Forms plugin to a version later than 6.3.316 once a patched release is available from the vendor.
• Disable the Super Forms plugin until a patched version is installed if the site allows open user registration.
• Disable open user registration (Anyone can register) in WordPress general settings where Subscriber accounts are not required.
• Audit all existing Super Forms configurations and remove any form that has file_upload_submission_delete enabled unexpectedly.

Patch Information

A fix is proposed in GitHub Pull Request #205 on the Super Forms repository. The patch introduces capability checks on the super_save_form handler and sanitizes the subdir input before passing it to SUPER_Common::delete_dir(). Administrators should install any plugin release that incorporates this pull request.

Workarounds

• Restrict access to wp-admin/admin-ajax.php for unauthenticated and low-privilege roles using a web application firewall rule that blocks action=super_save_form and action=super_submit_form requests from non-admin sessions.
• Enforce least-privilege by removing or demoting unnecessary Subscriber accounts and requiring email verification for new registrations.
• Apply strict filesystem permissions on wp-config.php and the WordPress root so the web server user cannot delete critical files.

# Configuration example: harden wp-config.php and disable open registration
chown root:www-data /var/www/html/wp-config.php
chmod 440 /var/www/html/wp-config.php

# Disable open user registration via WP-CLI
wp option update users_can_register 0

# Example WAF rule (ModSecurity) blocking the vulnerable AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026159831,msg:'Block Super Forms vulnerable AJAX actions'"
  SecRule ARGS:action "@rx ^(super_save_form|super_submit_form)$"