The super_forms plugin contains a Path Traversal flaw that allows an unauthenticated attacker to request any file readable by the web server process. By constructing a crafted download URL that includes traversal sequences, the attacker can obtain arbitrary files from the server, including configuration files, logs, or credentials. This results in a read‑only compromise, compromising confidentiality of sensitive data and potentially enabling further post‑exploitation steps.

All WordPress installations that have the Super Forms plugin version 6.3.315 or earlier, up to and including 6.3.316, are affected. The vulnerability does not impact core WordPress or other plugins. The fix was included in version 6.3.317.

The CVSS v3.1 score of 7.5 signals a high severity issue. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an unauthenticated HTTP GET request to the plugin’s download endpoint, making remote exploitation straightforward for anyone with network connectivity to the site.