CVE-2026-17196: Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an attacker-controlled extensions string from superelements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the superelements post meta via the supersaveform AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via superuploadfiles requires no authentication at all.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need a privileged WordPress account to exploit this issue?
The full attack requires an authenticated account with at least Subscriber-level access to poison the _super_elements post meta through the super_save_form AJAX handler. The later super_upload_files request does not require authentication, but it depends on the earlier metadata-poisoning step.
Which sites are most exposed?
Sites running an affected version that permit untrusted users to register or obtain Subscriber-level accounts are exposed to the documented attack path. An attacker can use that low-privilege account to alter the permitted upload MIME type map and then upload potentially executable files.
What is the likely impact if exploitation succeeds?
An attacker may upload files that can be executable, making remote code execution possible. The reported impact includes compromise of confidentiality, integrity, and availability.