Super Forms – Drag & Drop Form Builder vulnerabilities
7 known vulnerabilities in Super Forms – Drag & Drop Form Builder from WebRehab. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
Super Forms – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field d
- 8.8 High severity
Super Forms – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function
- 8.8 High severity
Super Forms – Drag & Drop Form Builder: Improper Privilege Management
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action=
- 9.1 Critical severity
Super Forms – Drag & Drop Form Builder: Path Traversal: '/dir/../filename'
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbi
- 8.1 High severity
Super Forms – Drag & Drop Form Builder: External Control of File Name or Path
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscr
- 9.8 Critical severity
Super Forms – Drag & Drop Form Builder: Improper Privilege Management
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submit
- 9.8 Critical severity
Super Forms – Drag & Drop Form Builder: Unrestricted Upload of File with Dangerous Type
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability che