Arbitrary File Deletion Vulnerability in Super Forms Plugin for WordPress

CVE-2026-15983

What is CVE-2026-15983?

The Super Forms - Drag & Drop Form Builder plugin for WordPress contains a vulnerability that allows authenticated users, including those with Subscriber-level access, to delete arbitrary files and directories. The issue arises from the 'super_save_form' AJAX handler, which inadequately checks user capabilities. When the 'file_upload_submission_delete' setting is enabled, attackers can exploit this by passing manipulated values directly into a deletion function, bypassing security checks. Consequently, this could lead to the deletion of critical files such as wp-config.php, risking the entire WordPress installation and potential remote code execution.

References