CVE-2026-15990: WordPress Formidable Charts Path Traversal

CVE-2026-15990 Overview

The Formidable Charts plugin for WordPress contains a directory traversal vulnerability in the frm_graph parameter. The flaw affects all versions up to and including 2.0.1. Unauthenticated attackers can read arbitrary files on the server by manipulating the parameter to escape the intended directory. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active. The wp-content/uploads/frm-charts/ directory must also exist, which occurs after an image-format chart is rendered.

Critical Impact
Unauthenticated attackers can read sensitive files including wp-config.php, exposing database credentials, authentication keys, and other secrets stored on the WordPress host.

Affected Products

Formidable Charts plugin for WordPress, versions up to and including 2.0.1
Requires Formidable Forms Lite active on the WordPress instance
Requires Formidable Forms Pro active on the WordPress instance

Discovery Timeline

2026-08-26 - CVE-2026-15990 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15990

Vulnerability Analysis

The Formidable Charts plugin exposes a chart-rendering handler that accepts a frm_graph parameter. The plugin passes attacker-controlled input to a file read operation without normalizing or restricting path components. Attackers can traverse outside the intended wp-content/uploads/frm-charts/ directory using ../ sequences. The handler is reachable without authentication, so any remote user can invoke it. Reading arbitrary files enables theft of configuration data, credentials, application source, and system files.

Root Cause

The vulnerability maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The plugin fails to canonicalize or validate the frm_graph value against an allowlist before opening the target file. This defect is a classic path traversal pattern where user input is concatenated with a base directory and passed to a file-read primitive.

Attack Vector

The attack is delivered over the network to the WordPress endpoint that handles chart rendering. The attacker sends a crafted request that supplies a traversal sequence in the frm_graph parameter, for example values containing ../../../../wp-config.php. Because the wp-content/uploads/frm-charts/ directory must exist for the request to reach the vulnerable code path, sites that have previously rendered an image chart are exposed. No user interaction and no privileges are required.

No verified public proof-of-concept code is available. Refer to the Wordfence vulnerability overview for additional technical context.

Detection Methods for CVE-2026-15990

Indicators of Compromise

HTTP requests containing the frm_graph parameter with traversal sequences such as ../, ..%2f, or URL-encoded variants
Web server access logs showing requests targeting the Formidable Charts endpoint with paths referencing wp-config.php, /etc/passwd, or .env
Presence of the wp-content/uploads/frm-charts/ directory combined with Formidable Charts version 2.0.1 or earlier

Detection Strategies

Inspect web application firewall (WAF) logs for frm_graph values containing directory traversal patterns and encoded equivalents
Correlate outbound file-read patterns with unauthenticated requests to plugin endpoints under /wp-admin/admin-ajax.php or plugin routes
Audit installed plugin versions across WordPress sites and flag any Formidable Charts instance below version 2.0.2

Monitoring Recommendations

Alert on repeated 200 responses to requests carrying suspicious frm_graph values, which indicate successful file reads
Monitor for anomalous access to sensitive files such as wp-config.php and Linux system files from web-server processes
Track new appearances of the frm-charts/ upload directory to identify sites transitioning from unaffected to exposed state

How to Mitigate CVE-2026-15990

Immediate Actions Required

Upgrade Formidable Charts to version 2.0.2 or later on every affected WordPress site
Deactivate the Formidable Charts plugin until patching is complete if immediate upgrade is not possible
Rotate WordPress secrets, database credentials, and API keys if evidence of exploitation exists in web logs

Patch Information

Formidable Forms released Formidable Charts 2.0.2 to address this vulnerability. See the Formidable Forms Charts 2.0.2 changelog for release details. Administrators should update through the WordPress plugin manager or by replacing plugin files with the fixed release.

Workarounds

Deploy WAF rules that block requests containing directory traversal sequences in the frm_graph parameter
Restrict access to the Formidable Charts endpoints using host-based or network-level allowlists until the patch is applied
Remove the wp-content/uploads/frm-charts/ directory on sites that do not require image-format charts, which blocks the vulnerable code path

bash

# Example WAF rule pattern (ModSecurity) to block traversal in frm_graph
SecRule ARGS:frm_graph "@rx (\.\./|\.\.%2f|%2e%2e/)" \
    "id:1026159901,phase:2,deny,status:403,\
    msg:'CVE-2026-15990 Formidable Charts path traversal attempt'"