CVE-2026-15896

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

• CWE-26

• https://github.com/RensTillmann/super-forms/pull/205
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3df045-1020-403f-8e10-a1b75261b769?source=cve

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15890The default AEAD nonce provider for the PSA Internal Trusted…5.3
• CVE-2026-15891The MQTT-SN client keepalive handler process_ping() in subsy…7.5
• CVE-2026-15892The mcumgr SMP settings-management group handlers settings_m…5.3
• CVE-2026-15893net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c …6.5
• CVE-2026-15894The Bluetooth Mesh On-Demand Private Proxy solicitation hand…8.8
• CVE-2026-15895OS command injection in the npm package loading component in…7.8
• CVE-2026-15897The Super Forms – Drag & Drop Form Builder plugin for WordPr…8.8
• CVE-2026-15899Use after free in CameraCapture in Google Chrome on Mac prio…9.6
• CVE-2026-1590A vulnerability was identified in itsourcecode School Manage…9.8
• CVE-2026-15900Use after free in GPU in Google Chrome on Android prior to 1…9.6
• CVE-2026-15901Use after free in Network in Google Chrome prior to 150.0.78…9.6
• CVE-2026-15902Use after free in Cast in Google Chrome prior to 150.0.7871.…8.8