Super Forms CVE-2026-28167

No special conditions are required beyond the target WordPress site having the Super Forms plugin installed, active, and running version 6.3.315 or earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations with no user interaction. The plugin does not need to be used or configured in any particular way - its mere presence and activation on the site exposes the vulnerable file download endpoint. Limiting factors: the attacker must be able to reach the WordPress site over HTTP/HTTPS (standard internet access or internal network depending on deployment); exploitation is constrained to files readable by the web server OS user (typically www-data), meaning files with restrictive OS permissions outside the web root may not be accessible.

The CVSS 3.1 base score of 7.5 (High) is driven by AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which accurately reflects unauthenticated network exploitation with no complexity barrier and significant confidentiality impact. There is no EPSS score provided in the source data, no CISA KEV listing, and no confirmed public proof-of-concept code, which moderates the urgency compared to a KEV-listed vulnerability. However, the attack class (path traversal for file read) is extremely well-understood and trivially weaponizable by any attacker with HTTP access to the WordPress site - the absence of a published PoC does not meaningfully reduce risk. The Patchstack report indicates this was responsibly disclosed, suggesting a vendor patch may be forthcoming or already available. Real-world priority should be HIGH for any organization running Super Forms ≤6.3.315 because exploitation requires no authentication, no user interaction, and yields credentials (wp-config.php) that enable full site compromise as a secondary step. Missing data: no EPSS score, no explicit confirmed fixed version, no indication of whether Patchstack's responsible disclosure resulted in an upstream patch prior to publication.

An unauthenticated attacker identifies a WordPress site running Super Forms ≤6.3.315 via HTTP response headers, page source plugin references, or WordPress plugin enumeration. The attacker sends a crafted HTTP request to the vulnerable file download endpoint with a path parameter containing traversal sequences such as '../../wp-config.php', causing the server to return the WordPress configuration file containing database credentials, authentication secret keys, and API tokens. With those credentials, the attacker can authenticate to the database directly or escalate to full site takeover. No public proof-of-concept has been confirmed, but the technique is standard and requires no specialized tooling.