Summary
Super Forms for WordPress contains an arbitrary file and directory deletion vulnerability caused by missing authorization checks and insufficient validation of an attacker-controlled directory value. An authenticated user with Subscriber-level access or higher may be able to delete files or directories within the server environment, potentially taking down the site and creating conditions for further compromise.
Affected context
The issue affects WordPress sites using the Super Forms – Drag & Drop Form Builder plugin where:
- Low-privileged authenticated users can access form-management functionality
- Form settings can enable deletion of uploaded submission files
- A submitted directory value reaches the deletion routine without adequate canonicalization or validation
- Path protection relies on a string comparison that may not match equivalent canonical paths
The resulting exposure depends on filesystem permissions and the web server's ability to remove the targeted paths.
Exploit preconditions
- Attack surface: WordPress AJAX handlers exposed by the Super Forms plugin
- Required access: Authenticated Subscriber-level access or higher
- Trigger point: Form submission processing that invokes the file or directory deletion function
- Required state: The attacker must be able to create or modify a form and enable the relevant file-deletion behavior
- Why exploitation is possible: User-controlled path data is passed to a recursive deletion routine without robust canonicalization, authorization, and boundary enforcement
Why this happens
The vulnerability combines broken access control with improper validation of file path input. The form-saving handler does not adequately verify the caller's capability, allowing a low-privileged user to configure behavior that reaches a deletion operation. The submission handler then uses attacker-controlled directory data in a recursive delete function, while a fragile path comparison can be bypassed by equivalent path representations. This behavior maps primarily to CWE-73: External Control of File Name or Path.
Potential impact
- Arbitrary files or directories may be deleted
- The WordPress installation could become unavailable
- Uploaded content, application assets, or configuration files may be removed
- Deletion of critical files could cause data loss or force site reinstallation
- A subsequent unauthorized reinstallation could create conditions for remote code execution
- Availability, integrity, and recovery processes may be affected
General mitigation guidance
Mitigation typically focuses on enforcing authorization and treating every path supplied through forms or requests as untrusted.
Common defensive patterns include:
- Require explicit capability checks for form creation, modification, and deletion-related settings
- Allow deletion only within a fixed, application-owned directory
- Canonicalize paths before validation and compare canonical values using consistent path semantics
- Reject traversal, absolute paths, symbolic-link escapes, and paths resolving outside the permitted root
- Prefer identifier-based file references over client-supplied directory names
- Apply least-privilege permissions to the web server and plugin-managed storage
- Use defense-in-depth controls such as read-only protection for application code and configuration files
- Preserve backups and recovery procedures that are independent of the web application
How teams detect issues like this
Organizations can look for:
- Static analysis findings where request parameters flow into filesystem deletion APIs
- Missing capability or authorization checks in AJAX handlers
- Path comparisons performed before canonicalization or using inconsistent trailing-slash handling
- Recursive delete functions receiving values derived from POST data, form fields, or serialized request data
- Code review signals involving user-controlled paths, symbolic links, traversal sequences, or application-root boundaries
- Runtime logs showing unexpected deletion requests, unusual form-setting changes, or removal of files outside upload directories
- Policy checks that restrict filesystem deletion to approved directories and approved service identities
Automated code review and taint-analysis tools may help identify request-to-filesystem data flows.
