CVE-2026-28167 HIGH

CVE-2026-28167: WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Vendor Super Forms
Product Super Forms
Weakness CWE-22 · Path traversal
Published August 24, 2026
Last update August 24, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Super Forms versions up to 6.3.315 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft requests to access files outside the intended directory, potentially exposing sensitive configuration files, database credentials, or other confidential data. No user interaction is required.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server, including sensitive configuration and credential files.

Potential impact on your site

04Site Impact

Attackers can access sensitive files like wp-config.php, database backups, or private keys without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 24, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE-2026-18352 User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension CVE-2026-32477 WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension