CVE-2026-28167: WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Published Aug 24, 2026
·Updated
Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
Affected Software
1 affected component
WordPress Super Forms<=6.3.315
Event History
Aug 24, 2026
CVE Published
via MITRE·11:54 AM
Data Sourced
via MITRE·11:54 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No credentials or user interaction are required.
2
What is the likely impact of successful exploitation?
The vulnerability allows arbitrary file download through path traversal. The stated impact is high confidentiality impact, with no integrity or availability impact indicated.
3
Which installations are affected?
WordPress sites using Super Forms version 6.3.315 or earlier are affected.