Summary
A critical vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin allows unauthenticated attackers to delete directories through the form submission handler. The risk becomes significant when the administrator-enabled option to delete server files after submissions is active and attacker-controlled field declarations are accepted without adequate schema and path validation.
A critical vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin allows unauthenticated attackers to delete directories through the form submission handler. The risk becomes significant when the administrator-enabled option to delete server files after submissions is active and attacker-controlled field declarations are accepted without adequate schema and path validation.
Affected context
The vulnerability occurs in WordPress installations using the Super Forms plugin's submit_form functionality, particularly when the setting that deletes files from the server after form submissions is enabled. Exploitation depends on the handler processing attacker-controlled JSON field declarations without reliably confirming that they match the configured form schema or remain within an intended directory boundary.
The vulnerability occurs in WordPress installations using the Super Forms plugin's submit_form functionality, particularly when the setting that deletes files from the server after form submissions is enabled. Exploitation depends on the handler processing attacker-controlled JSON field declarations without reliably confirming that they match the configured form schema or remain within an intended directory boundary.
Exploit preconditions
- Attack surface: The publicly reachable form submission endpoint
- Required access: No authentication may be required when a vulnerable form is accessible
- Configuration requirement: An administrator must have enabled deletion of server files after form submissions
- Trigger point: Processing of a crafted form submission by the
submit_formfunction - Why exploitation is possible: Insufficient field-schema validation permits attacker-controlled deletion inputs, while the directory boundary check does not reliably prevent traversal to broader filesystem locations
- Attack surface: The publicly reachable form submission endpoint
- Required access: No authentication may be required when a vulnerable form is accessible
- Configuration requirement: An administrator must have enabled deletion of server files after form submissions
- Trigger point: Processing of a crafted form submission by the
submit_formfunction - Why exploitation is possible: Insufficient field-schema validation permits attacker-controlled deletion inputs, while the directory boundary check does not reliably prevent traversal to broader filesystem locations
Why this happens
The underlying issue is inadequate validation of attacker-controlled JSON field declarations against the actual form schema, combined with ineffective filesystem path boundary enforcement. The path guard relies on an ABSPATH comparison that can be bypassed because dirname() removes a trailing separator, allowing a derived path to appear valid without remaining within the intended directory. This behavior is associated with CWE-434, reflecting insufficient restriction of file-related operations and unsafe handling of attacker-influenced filesystem targets.
The underlying issue is inadequate validation of attacker-controlled JSON field declarations against the actual form schema, combined with ineffective filesystem path boundary enforcement. The path guard relies on an ABSPATH comparison that can be bypassed because dirname() removes a trailing separator, allowing a derived path to appear valid without remaining within the intended directory. This behavior is associated with CWE-434, reflecting insufficient restriction of file-related operations and unsafe handling of attacker-influenced filesystem targets.
Potential impact
- Arbitrary directories may be recursively deleted
- The WordPress installation may become unavailable or corrupted
- Application files, uploaded content, and configuration data could be removed
- Recovery may require restoration from trusted backups
- Availability loss could affect dependent sites or services
- Arbitrary directories may be recursively deleted
- The WordPress installation may become unavailable or corrupted
- Application files, uploaded content, and configuration data could be removed
- Recovery may require restoration from trusted backups
- Availability loss could affect dependent sites or services
General mitigation guidance
Mitigation generally focuses on reducing trust in submitted field declarations and enforcing robust filesystem boundaries.
Common defensive patterns include:
- Allowing deletion only for server-generated paths mapped to approved resources
- Validating submitted fields against a server-side form schema
- Canonicalizing paths before comparison and enforcing strict containment under an approved directory
- Rejecting symbolic links, parent-directory components, empty paths, and unexpected path types
- Separating file cleanup from unauthenticated request handling where feasible
- Disabling server-side deletion features unless they are required
- Running the WordPress process with the minimum filesystem permissions necessary
- Maintaining tested backups and recovery procedures for application files
Mitigation generally focuses on reducing trust in submitted field declarations and enforcing robust filesystem boundaries.
Common defensive patterns include:
- Allowing deletion only for server-generated paths mapped to approved resources
- Validating submitted fields against a server-side form schema
- Canonicalizing paths before comparison and enforcing strict containment under an approved directory
- Rejecting symbolic links, parent-directory components, empty paths, and unexpected path types
- Separating file cleanup from unauthenticated request handling where feasible
- Disabling server-side deletion features unless they are required
- Running the WordPress process with the minimum filesystem permissions necessary
- Maintaining tested backups and recovery procedures for application files
How teams detect issues like this
Detection can combine static analysis, code review, runtime monitoring, and configuration policy checks.
Useful review signals include:
- File or directory deletion based on request parameters or JSON fields
- Path checks that compare uncanonicalized strings or depend on trailing separators
- Recursive deletion functions reached from public form handlers
- Missing server-side schema validation for submitted field declarations
- Administrative settings that enable destructive filesystem actions
Runtime monitoring can alert on recursive deletion activity, unexpected changes beneath the WordPress root, and form submissions that reference paths outside approved storage locations. Automated security review tools may help identify dangerous filesystem APIs and missing authorization or path-containment controls.
Detection can combine static analysis, code review, runtime monitoring, and configuration policy checks.
Useful review signals include:
- File or directory deletion based on request parameters or JSON fields
- Path checks that compare uncanonicalized strings or depend on trailing separators
- Recursive deletion functions reached from public form handlers
- Missing server-side schema validation for submitted field declarations
- Administrative settings that enable destructive filesystem actions
Runtime monitoring can alert on recursive deletion activity, unexpected changes beneath the WordPress root, and form submissions that reference paths outside approved storage locations. Automated security review tools may help identify dangerous filesystem APIs and missing authorization or path-containment controls.
