Super Forms CVE-2026-17609

Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting - without this feature active, the vulnerable deletion code path is not reached. Given that prerequisite, exploitation is remote and unauthenticated (PR:N) with no user interaction, triggered by sending crafted JSON field declarations to the submit_form function that evade schema validation; the ineffective ABSPATH guard is defeated because dirname() strips the trailing slash. The primary limiting factor is the non-default configuration dependency (the deletion feature must be on); affected versions are all releases up to and including 6.3.316.

This is a high-priority issue that warrants prompt patching, but its real-world risk is gated by a configuration precondition rather than being universally exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity flaw with high integrity and availability impact (C:N/I:H/A:H, base 9.1) - recursive deletion of arbitrary directories including the WordPress root can fully destroy a site, which justifies the critical scoring. Confirming signals: the vulnerability was reported by Wordfence (a credible threat-intel source) and a fix exists (GitHub PR #205). Conflicting/limiting signals: exploitation is NOT possible against a default install - it requires an administrator to have enabled the 'Delete files from server after form submissions' setting, which is a target-specific, non-attacker-controlled condition the raw CVSS AC:L does not reflect (CVSS 4.0's AT:P captures this better). No EPSS score, KEV listing, or public exploit code was provided in the input, so current active-exploitation evidence is absent. Net: a genuinely dangerous flaw in deployments that enabled the deletion feature, but the 9.1 likely overstates risk for the subset of installs running default configuration.

An unauthenticated attacker identifies a WordPress site running Super Forms with the 'Delete files from server after form submissions' feature enabled, then submits a crafted form request to the submit_form endpoint containing malicious JSON field declarations whose paths are not validated against the real form schema. Because the ABSPATH guard is bypassed by dirname() stripping the trailing slash, the plugin recursively deletes an attacker-chosen directory - up to and including the WordPress root - causing total site destruction. No public exploit code is identified at time of analysis, though a patch PR publicly documents the vulnerable logic.