Directory Traversal Vulnerability in Formidable Charts Plugin for WordPress

CVE-2026-15990

What is CVE-2026-15990?

The Formidable Charts plugin for WordPress is affected by a directory traversal vulnerability that allows unauthenticated users to access and read files on the server. This vulnerability arises through the 'frm_graph' parameter, enabling attackers to exploit it for unauthorized access to sensitive data. Exploitation requires that the plugin is active in conjunction with the Formidable Forms Lite or Pro versions, alongside the presence of the wp-content/uploads/frm-charts/ directory, typically created when rendering chart images.

References