WebRehab vulnerabilities
We track 8 vulnerabilities in WebRehab products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest WebRehab vulnerabilities
- 9.1 Critical severity
Super Forms – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field d
- 8.8 High severity
Super Forms – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function
- 8.8 High severity
Super Forms – Drag & Drop Form Builder: Improper Privilege Management
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action=
- 9.1 Critical severity
Super Forms – Drag & Drop Form Builder: Path Traversal: '/dir/../filename'
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbi
- 8.1 High severity
Super Forms – Drag & Drop Form Builder: External Control of File Name or Path
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscr
- 9.8 Critical severity
Super Forms – Drag & Drop Form Builder: Improper Privilege Management
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submit
- 7.5 High severity
Super Forms: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
- 9.8 Critical severity
Super Forms – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability che