External risk intelligence

Super Forms WordPress Plugin Directory Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-15896

The vulnerability affects a WordPress plugin designed for form building, which is intended for public-facing web interaction. Because the default configuration requires no authentication for file uploads, the vulnerable component is directly accessible to any internet user visiting the website.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Super Forms WordPress plugin, affecting all versions up to 6.3.316. This issue allows unauthenticated attackers to potentially access sensitive information on your server by reading arbitrary files. While a specific setting can mitigate unauthenticated exploitation, the core path traversal weakness remains.

Attackers can read server files.
Protects sensitive customer or business data.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could start with access to any website using the Super Forms plugin. By sending a specially crafted request to the plugin's `parse_request` function, an unauthenticated user can trick the plugin into accessing arbitrary files on the server. This could reveal sensitive information or lead to further compromise if file uploads are enabled.

No authentication required for exploitation.
Directory traversal in `parse_request` function.
Sensitive file disclosure and potential further compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to read arbitrary files from the server when the Super Forms plugin's file upload functionality is enabled. The specific files that can be read depend on the server's file system structure and the attacker's ability to guess or discover file paths.

Arbitrary server files.
Via directory traversal in file uploads.
Sensitive information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a widely used WordPress form builder impacts application owners and potentially infrastructure or platform teams responsible for the WordPress environment. The initial focus should be on identifying all WordPress sites using this plugin, confirming if the affected functionality is exposed externally, and assessing business criticality. This will help determine the accountable owner and inform a risk-based remediation plan, which may involve vendor coordination or temporary controls.

Application owners should triage.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Super Forms plugin for WordPress?

Super Forms is a drag-and-drop form builder plugin used on WordPress sites to create custom web forms. It allows site administrators to collect user input, manage file uploads, and facilitate interaction between visitors and the website backend.

What does CVE-2026-15896 mean for my server?

This CVE indicates a directory traversal vulnerability, categorized as CWE-26. It means the plugin fails to properly restrict file path requests, allowing an attacker to navigate outside the intended folder structure to read arbitrary files stored on the underlying server.

How does an attacker trigger this directory traversal?

The attack targets the plugin's parse_request function. It works when the file upload feature is enabled on a form. The vulnerability does not trigger if file uploads are entirely disabled, as the mechanism relies on the plugin's file handling process to facilitate the unauthorized path request.

Is my website at risk if it uses Super Forms?

According to Halo Surface Signal, this vulnerability is very likely to impact public-facing websites. Since the plugin is designed for forms intended for internet users and the default configuration often permits unauthenticated file uploads, any internet-connected WordPress site using this plugin is directly reachable by potential attackers.

Do I need to take action to protect my site?

Yes, you should begin by auditing your WordPress environment to identify all installations running this plugin. Determine if file uploads are currently enabled on your forms and assess the sensitivity of data stored on your server to prioritize your response while awaiting further guidance or official updates from the plugin developers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.