Super Forms
Monthly
Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.
Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.