Technical impact
The Super Forms plugin suffers from an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that allows an unauthenticated attacker to request any file readable by the web server process. By constructing a crafted download URL that includes traversal sequences, the attacker can obtain arbitrary files from the server, including configuration files, logs, or credentials. This weakness corresponds to CWE-22. This results in a read‑only compromise, compromising confidentiality of sensitive data and potentially enabling further post‑exploitation steps.
Affected Systems
All WordPress installations that have the WebRehab Super Forms plugin version 6.3.315 or earlier, up to and including 6.3.316, are affected. The vulnerability does not impact core WordPress or other plugins. The fix was included in version 6.3.317.
Risk and Exploitability
The CVSS v3.1 score of 7.5 signals a high severity issue. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an unauthenticated HTTP GET request to the plugin’s download endpoint, making remote exploitation straightforward for anyone with network connectivity to the site.
