CVE-2026-28167

CVE-2026-28167 is an unauthenticated arbitrary file download vulnerability in the WordPress Super Forms plugin affecting versions 6.3.315 and below . The flaw allows a remote attacker to download arbitrary files from the server without authentication, leading to a high confidentiality impact (CVS...