WordPress Super Forms Plugin Arbitrary File Deletion

CVE-2026-15983 exposes a critical vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin (versions up to 6.3.316) that allows low-privileged Subscriber-level users to arbitrarily delete files and directories on affected servers. The vulnerability stems from two compounding weaknesses: the `super_save_form` AJAX handler lacks capability checks, enabling any authenticated user to modify form settings, and the `super_submit_form` handler's `submit_form` function fails to properly validate the attacker-controlled `files[].subdir` parameter. This combination permits attackers to manipulate file deletion operations by specifying arbitrary directory paths. Website administrators running WordPress installations with this plugin are at significant risk, particularly sites with open registration policies that allow subscribers to create accounts, as the attack requires only basic authentication.

While this CVE currently lacks mapped MITRE ATT&CK techniques, Casky's security skills powered by Claude AI would detect attack patterns consistent with Impact techniques, specifically T1485 (Data Destruction) and T1561 (Disk Wipe), through behavioral analysis of AJAX handler invocations combined with filesystem operations. Practitioners using Casky would observe findings highlighting: unauthorized capability usage in WordPress hooks, suspicious form parameter manipulation targeting file path variables, and anomalous filesystem deletion patterns tied to unauthenticated or low-privilege user contexts. Claude's extended reasoning would correlate the absence of nonce validation and capability checks in AJAX handlers with elevated risk patterns, surfacing this as a privilege escalation leading to destructive file operations — enabling security teams to identify compromised form configurations and malicious submission attempts before filesystem damage occurs.