Super Forms Hit by Second Critical Flaw in Months: Update Now

October 11, 2026 Qamar Abbas 8 min read

Super Forms Hit by Second Critical Flaw in Months: Update Now

The Super Forms directory deletion vulnerability (CVE-2026-17609, CVSS 9.1) lets an unauthenticated attacker recursively delete any directory on your server — including your entire WordPress installation. Disclosed on October 8, 2026, the Super Forms directory deletion flaw affects every version of Super Forms – Drag & Drop Form Builder up to and including 6.3.316, a plugin active on more than 13,000 sites. The fix is a single update to version 6.3.317 or later. This is the same plugin’s second critical flaw in months, and the Super Forms directory deletion bug is arguably worse than the first — it needs no account, no interaction, and no victim at all.

What Happened: the Super Forms Directory Deletion Flaw

CVE-2026-17609 is an unauthenticated arbitrary directory deletion vulnerability in the plugin’s submit_form function. The Super Forms directory deletion issue comes from two defects working together: the plugin fails to validate attacker-controlled JSON field declarations against the actual form schema, and a path guard meant to confine file operations inside the WordPress directory can be bypassed. Wordfence’s threat-intelligence write-up describes a guard that checks the path against ABSPATH, the WordPress install directory — but because PHP’s dirname() strips the trailing slash, an attacker-supplied path resolves outside the intended directory while the naive string comparison still passes. The Super Forms directory deletion attack then flows straight into the plugin’s recursive directory-deletion routine.

There is one precondition, and it is important to state it precisely: exploitation requires that a site administrator has enabled the plugin’s “Delete files from server after form submissions” setting. That is a documented, commonly-enabled feature — sites that use Super Forms for job applications, support tickets, or any workflow with file uploads frequently turn it on to avoid disk bloat. If that setting is on and you are running 6.3.316 or earlier, you are exposed to the Super Forms directory deletion flaw. If it is off, the attack path is closed — but updating is still the right move, because a single settings change later would reopen it.

The Super Forms directory deletion CVE was assigned by Wordfence (reserved July 27, 2026, published October 7, 2026, record updated October 10), and researcher d.v4n_s3c is credited with the discovery. The vendor, WebRehab (Rens Tillmann), shipped the fix in 6.3.317 — see the upstream fix pull request for the patch. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) tells the story: network-accessible, low complexity, no privileges, no user interaction, with high impact on integrity and availability. There is no confirmed public proof of concept, and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog — yet.

Who Is Affected by the Super Forms Directory Deletion Flaw

Any site running Super Forms – Drag & Drop Form Builder version 6.3.316 or older with the file-deletion-after-submission setting enabled is in the Super Forms directory deletion blast radius. With 13,000+ active installations, the exposed population includes business contact forms, HR job-application portals, customer-support ticket systems, and event registrations — workflows that routinely handle file uploads and therefore routinely enable the deletion setting. Those are exactly the sites where a vanished WordPress installation is a business emergency, not a hobby inconvenience.

There is also a darker pattern worth noting. The Super Forms directory deletion flaw is the plugin’s second critical vulnerability this year. Back in July, a file-upload flaw (CVE-2026-14894) in Super Forms drew more than 250,000 blocked exploit attempts in mass-scanning campaigns. And a related authenticated variant — CVE-2026-15983, an arbitrary file and directory deletion flaw reachable by Subscriber-level users through the plugin’s AJAX form-saving handler (disclosed September 30, 2026, CVSS 8.1) — was fixed in the same 6.3.317 release. Three deletion-class disclosures in one plugin in three months points to file-handling code that has never been systematically hardened. If you run Super Forms, the Super Forms directory deletion patch is urgent; if you run it with the deletion setting on, it is an emergency.

Why the Super Forms Directory Deletion Flaw Matters

Most critical WordPress flaws steal something — data, sessions, credentials. The Super Forms directory deletion flaw destroys something. Recursive directory deletion from an unauthenticated request means an attacker can wipe wp-content, the uploads folder, the theme and plugin directories, and finally the WordPress core itself — a complete site erasure that no backup-less site survives gracefully. Backups are the only reliable recovery, and many small sites that use form builders for simple contact pages are precisely the sites whose backups are stale or nonexistent.

The precondition does not make this a low-risk issue. The “Delete files from server after form submissions” toggle exists specifically for high-volume form workflows, and administrators enable it deliberately to keep hosting disks from filling with applicant resumes and support attachments. Attackers know this: automated scanners probe for the Super Forms directory deletion parameter pattern (data[...][files][][subdir]) and will find the vulnerable installs fast. The July file-upload flaw’s 250,000+ blocked attempts show exactly how quickly this plugin’s install base gets swept. The Super Forms directory deletion disclosure gives scanners a new, fully unauthenticated weapon.

What to Do Now After the Super Forms Directory Deletion Disclosure

Treat the Super Forms directory deletion flaw as a patch-now emergency if the deletion setting is enabled on your site, and as a patch-this-week priority regardless.

Update Super Forms to 6.3.317 or later immediately. This single update closes CVE-2026-17609 and the related authenticated deletion flaw CVE-2026-15983.
Check whether the “Delete files from server after form submissions” setting was enabled. If it was, assume the Super Forms directory deletion path was exposed and review access logs for malformed data[files][subdir] submissions or JSON payloads targeting the form-submit endpoint.
Verify your site’s integrity right now. Look for missing directories, broken media links, or empty upload folders. A site that suddenly lost wp-content has already been hit by the Super Forms directory deletion attack.
Confirm your backups are current and restorable. A deletion-class flaw makes backup verification — not just backup existence — the decisive control. Test-restore to a staging copy if you have never done it.
Leave the deletion setting OFF unless you genuinely need it. If the Super Forms directory deletion precondition stays disabled, the worst-case attack surface of any future similar flaw shrinks dramatically. Manage upload-folder growth with a scheduled cleanup job instead.
Scan for follow-on compromise. Directory deletion is usually the attack itself, but a deleted wp-config.php followed by a fresh attacker-controlled install is a documented takeover path — check for unexpected admin accounts and unfamiliar files.
Put updates on autopilot with a professional maintenance plan. The Super Forms directory deletion saga is the third deletion-class disclosure in this plugin in three months; manual patching cannot keep up with that cadence. Qamar Digital Ventures LLC‘s website care plans include same-day patching and security monitoring — visit https://qamardigitalventuresllc.com/ to get covered.

Super Forms Directory Deletion: Frequently Asked Questions

What is the Super Forms directory deletion vulnerability?
CVE-2026-17609, a critical (CVSS 9.1) unauthenticated arbitrary directory deletion flaw in Super Forms – Drag & Drop Form Builder versions up to 6.3.316. Attackers submit crafted JSON through the plugin’s form-submission handler, bypass a path guard, and recursively delete any server directory — including the whole WordPress install.

Which versions are affected by the Super Forms directory deletion flaw?
All versions from 0 through 6.3.316. Version 6.3.317 and later fix it. Exploitation additionally requires the administrator to have enabled the plugin’s “Delete files from server after form submissions” setting.

Is there evidence of active exploitation?
No public proof of concept is confirmed and the CVE is not in CISA’s KEV catalog, but the plugin’s July file-upload flaw attracted over 250,000 blocked exploit attempts, and threat-intelligence analysts consider this plugin’s install base a prime mass-scanning target. Patch before the scanners arrive.

How do I know if my site was already attacked?
Review web-server logs for requests carrying data[files][subdir]-style parameters or unusual JSON to the form-submission endpoint, and verify that wp-content, uploads, and other directories are intact. Missing directories are the signature of the Super Forms directory deletion attack.

Super Forms Directory Deletion: Conclusion

The Super Forms directory deletion flaw (CVE-2026-17609, CVSS 9.1) is one of the nastiest shapes a WordPress vulnerability can take: fully unauthenticated, fully remote, and capable of recursively deleting your entire site when a common admin setting is enabled. The patch — version 6.3.317 — is a single update, and taking it now is the difference between a routine maintenance task and a full disaster-recovery operation. The context makes the urgency clearer: this is the plugin’s second critical disclosure this year, following July’s file-upload flaw that drew a quarter-million blocked exploit attempts, plus a sibling deletion flaw fixed in the same release. Form builders are high-value targets because they sit on public pages handling user input, and Super Forms has now proven three times in three months that its file-handling code deserves suspicion.

Deletion-class flaws punish the unprepared and reward the maintained. Qamar Digital Ventures LLC’s website care plans keep WordPress core, themes, and plugins patched the same day fixes land, with security monitoring that catches compromise attempts before they become wipeouts. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss a care plan for your site.

Sources

Free website & SEO audit

Want results like these?

Get a plain-English teardown of your website and Google visibility — what is broken, what to fix first, and what it would take to outrank your competitors in Albuquerque.

Get My Free Audit

No pressure, no 40-page PDF. Real answers.