boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-28167

CVE-2026-28167HIGH
Super Forms Super Forms — WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0050   41.7     —
AFFECTED
  Product      Versions  Fixed
  Super Forms  n/a –     6.3.317
TIMELINE
  Feb 25  Reserved by Patchstack
  Aug 24  Published (CNA: Patchstack)
  Oct 14  PATCH SHIPPED — CVE-2026-28167 (Super Forms). Fixed in Super Forms 6.3.317.
CWE-22 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Super Forms allows Path Traversal. This issue affects Super Forms: from n/a through 6.3.316.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
February 25, 2026ReservedReserved by Patchstack
August 24, 2026PublishedPublished (CNA: Patchstack)
October 14, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-28167 (Super Forms). Fixed in Super Forms 6.3.317.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
Super FormsSuper Forms—n/a6.3.317

Weaknesses

CWE-22

References (1)

Related

Authoritative record: CVE-2026-28167 at cve.org

Vendors: super forms

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-28167 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.