Security Alert Summary
The Formidable Charts plugin for WordPress is affected by a directory traversal vulnerability (CVE-2026-15990) that allows unauthenticated attackers to read arbitrary files on the server via a crafted frm_graph parameter. Successful exploitation requires Formidable Forms Lite or Pro and Formidable Charts to be active, and the wp-content/uploads/frm-charts/ directory to exist.
CVE Details
- CVE ID: CVE-2026-15990
- Affected component: Formidable Charts plugin for WordPress
- Affected versions: All versions up to and including 2.0.1
- Published: August 26, 2026 at 2:17:07 PM UTC
- Last modified: August 26, 2026 at 4:19:05 PM UTC
- CVSS v3.1: Base Score 7.5, Severity HIGH, Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User interaction: No authentication required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- CWE / Weakness: CWE-22 (Path Traversal)
- Exploitation prerequisites noted: Formidable Forms Lite or Pro and Formidable Charts must be active, and the
wp-content/uploads/frm-charts/directory must exist (typically created after rendering an image-format chart).
Technical Details
The vulnerability is a directory traversal issue in the Formidable Charts plugin that is triggered via the frm_graph parameter. An attacker can craft a request that uses path traversal sequences to cause the plugin to read files outside the intended directory. Because the plugin can expose files from the server filesystem, successful exploitation allows an unauthenticated attacker to retrieve the contents of arbitrary files that the webserver user can read.
The exploitability depends on the presence of the wp-content/uploads/frm-charts/ directory, which is normally created when an image-format chart is rendered. The plugin does not sufficiently validate or sanitize the frm_graph parameter to prevent traversal outside the charts directory, resulting in arbitrary file read access.
Impact is restricted to information disclosure of readable files. There is no CVE data indicating direct privilege escalation, integrity modification, or availability disruption via this vulnerability.
How This Could Impact Your Website
In a realistic scenario, a site owner hosts Formidable Charts and multiple users are present: an administrator who manages plugins, staff members who publish content, and an external contractor who supplies data for charts. If an attacker exploits this directory traversal, they could read server files that may include configuration files or exported data. This could expose internal user email addresses or other sensitive information stored in readable files.
Practical consequences include exposure of internal contact information and an increased risk of targeted phishing or social engineering against staff or contributors who appear in exposed files. The attack does not necessarily allow the attacker to modify site content or take the site offline based on the provided data, but the loss of confidentiality can enable follow-on social engineering attacks.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Verify whether the
wp-content/uploads/frm-charts/directory exists and review its contents for unexpected files. - Review and reduce unnecessary user roles, especially contributor-level accounts and other non-admin accounts with write access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and server logs for unusual file access patterns or unexpected requests referencing the
frm_graphparameter.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
