CVE-2026-17196
Received Received - Intake

Unrestricted File Upload in Super Forms WordPress Plugin

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Wordfence

Description
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-17196
EUVD
EUVD-2026-94737

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WebRehab Super Forms – Drag & Drop Form Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Super Forms WordPress plugin. It allows authenticated attackers with Subscriber-level access or higher to upload malicious files by bypassing file type restrictions. The plugin fails to properly validate file types during uploads, enabling remote code execution. Attackers can first manipulate plugin settings to allow dangerous file types, then upload executable files without further authentication.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially in uploads folders. Look for files with unusual extensions or recent timestamps. Review WordPress user roles for unauthorized Subscriber-level accounts. Inspect _super_elements post meta entries for unexpected values.

Impact Analysis

If you use the vulnerable Super Forms plugin, attackers could upload malicious files to your WordPress site. This could lead to complete site takeover, data theft, or malware distribution. Even low-privilege users like subscribers can exploit this to gain control of your website.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Update the Super Forms plugin to the latest version immediately. Remove or disable the plugin if an update is unavailable. Audit user roles and remove unauthorized Subscriber accounts. Monitor file uploads and server logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart