Super Forms CVE-2026-15983

Requires an authenticated WordPress account at Subscriber level or above (PR:L) on a site running Super Forms - Drag & Drop Form Builder ≤6.3.316; sites allowing open user registration effectively remove this barrier. No special pre-existing configuration is needed because the attacker self-enables the file_upload_submission_delete setting via the capability-check-less super_save_form handler; no user interaction and no admin involvement are required. Exploitation is network-reachable via the plugin's AJAX endpoints (super_save_form and super_submit_form). The only meaningful limiter is the authenticated-account prerequisite.

This is a genuinely high-priority vulnerability, not a CVSS-inflated paper risk. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, 8.1) is internally consistent and credible: remotely reachable AJAX handlers, low attack complexity, and only Subscriber-level privileges (the lowest authenticated tier, trivially obtained on any site with open registration). The dual-flaw root cause - a missing capability check on super_save_form letting low-privilege users flip the file_upload_submission_delete setting, chained with an unsanitized subdir value flowing into SUPER_Common::delete_dir() past a trailing-slash-broken ABSPATH guard - is specific and well-described, indicating a thorough Wordfence analysis rather than an automated scan. Impact is destructive (I:H/A:H): recursive deletion up to the entire WordPress root, i.e. full site takedown. The 'potential RCE' framing in the description is conditional and indirect (deleting wp-config.php could enable a takeover only if a third party re-installs the site), so it should be treated as a secondary, scenario-dependent outcome rather than direct code execution - the real, reliable impact is destruction/availability. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data; a GitHub PR (#205) is the upstream fix, not an exploit. Exploitation status: no public exploit identified at time of analysis. The main limiter on real-world risk is the requirement for an authenticated account, but on sites permitting self-registration this barrier is minimal.

An attacker registers (or already holds) a Subscriber-level account on a WordPress site running Super Forms ≤6.3.316, then calls the unprotected super_save_form AJAX handler to create or modify a form with the file_upload_submission_delete setting enabled. They submit the form via super_submit_form with a crafted files[].subdir value such as 'wp-config.php', which flows unsanitized into SUPER_Common::delete_dir() and defeats the broken ABSPATH guard, recursively deleting arbitrary files up to the entire WordPress install. No public POC is identified, but the chain is fully described and low-complexity.