Super Forms CVE-2026-15896

Exploitation requires that a Super Forms form with the file upload feature be enabled on the site (file upload must be active for the parse_request path to be reachable), which is a common deployment state. In the DEFAULT configuration the 'file_upload_auth' setting is empty, so NO authentication is required for unauthenticated attackers; enabling 'file_upload_auth' mitigates unauthenticated exploitation but does not remediate the underlying traversal. A platform-specific limiting factor applies on Linux, where a real 13-digit timestamp directory must exist - but the plugin's file-upload response discloses the created directory name, defeating this limitation; on Windows the traversal succeeds with any hardcoded 13-digit prefix. Affected: all versions up to and including 6.3.316.

This is a credible high-priority issue, though the supplied signals are internally inconsistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U) correctly reflects remote, unauthenticated, low-complexity exploitation against the default configuration, where the optional 'file_upload_auth' setting is empty. However, the impact metrics in the input (C:N/I:H/A:H) contradict the description: this is an arbitrary file READ (directory traversal, CWE-26), which is fundamentally a CONFIDENTIALITY breach and should be C:H/I:N/A:N - the input vector appears mislabeled and should be verified with Wordfence/NVD. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The vulnerability is NOT in CISA KEV and no POC flag was supplied, so there is no public exploit identified at time of analysis; the only exploit-adjacent artifact is the GitHub pull request (PR #205), which represents the FIX rather than weaponized exploit code. Net: a genuinely serious unauthenticated information-disclosure flaw in a widely-sold WordPress plugin, but with no evidence of active exploitation and a demonstrably inconsistent impact vector that should be corrected before the raw 9.1 is used for prioritization.

An unauthenticated attacker locates a WordPress site running Super Forms with any form that has file upload enabled (the default). They submit a file upload, read the created 13-digit timestamp directory name returned in the response, then issue a crafted request to the parse_request function using '../' sequences to read sensitive files such as wp-config.php, harvesting database credentials and secret keys. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) and lack of required authentication make this straightforward against default installations.