CVE-2026-17196

{
  "etk_id": "ETK-2026-938",
  "cve_id": "CVE-2026-17196",
  "display_id": "CVE-2026-17196",
  "ghsa_id": "GHSA-r223-f6qv-r3gw",
  "euvd_id": "EUVD-2026-94737",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted file upload in Super Forms WordPress plugin",
  "summary": "Super Forms – Drag & Drop Form Builder for WordPress is affected through version 6.3.316. A Subscriber-level or higher account can prepare form settings that allow unsafe uploads; the resulting upload path may then be reachable without authentication and could permit execution of uploaded files.",
  "mitigation": "Disable or remove the plugin until the maintainer provides an update, as no fixed version is recorded. Restrict untrusted account registration and review existing form settings and uploaded files for unauthorized changes.",
  "vendor": "WebRehab",
  "product": "Super Forms – Drag & Drop Form Builder",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 6.3.316"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Super Forms – Drag & Drop Form Builder",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0053,
  "epss_percentile": 0.4417,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 53.8735221,
  "t0_at": "2026-10-08T04:28:51.005000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T04:28:51.005000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T04:28:51.005000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17196"
    }
  }
}