Is CVE-2026-15990 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15990 being exploited in the wild.

How severe is CVE-2026-15990?

High severity, with a CVSS score of 7.5, published 26 August 2026.

Which products and versions are affected?

Formidable Charts up to 2.0.1; Formidable Forms Lite all versions (required for exploitation); Formidable Forms Pro all versions (required for exploitation).

Is there a fix for CVE-2026-15990?

A patch was published on 2026-08-25: Charts v2.0.2 released with security improvements to graph image handling Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15990 attacked?

It is attacked over the network.

Am I affected by CVE-2026-15990?

Check whether you run Formidable Charts, Formidable Forms Lite or Formidable Forms Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15990: Formidable Charts directory traversal via frm_graph parameter

CVE-2026-15990 · Severity: high · CVSS 7.5 · Published 2026-08-26

Formidable Charts is a WordPress plugin that extends the Formidable Forms platform to render data visualizations. A directory traversal vulnerability in versions up to 2.0.1 allows unauthenticated attackers to read arbitrary files from the web server, potentially exposing sensitive configuration files, database credentials, or other confidential data stored on the server.

Vendors: Formidable.

Quick answers

Is CVE-2026-15990 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15990 being exploited in the wild.
How severe is CVE-2026-15990?: High severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?: Formidable Charts up to 2.0.1; Formidable Forms Lite all versions (required for exploitation); Formidable Forms Pro all versions (required for exploitation).
Is there a fix for CVE-2026-15990?: A patch was published on 2026-08-25: Charts v2.0.2 released with security improvements to graph image handling Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15990 attacked?: It is attacked over the network.
Am I affected by CVE-2026-15990?: Check whether you run Formidable Charts, Formidable Forms Lite or Formidable Forms Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a directory traversal (path traversal) flaw in the 'frm_graph' parameter of the Formidable Charts plugin. Unauthenticated attackers can exploit this to access arbitrary files on the server without requiring authentication. The attack requires that Formidable Forms (Lite or Pro) and Formidable Charts are both active, and that the wp-content/uploads/frm-charts/ directory exists (typically created after rendering an image-format chart). The vulnerability was patched in version 2.0.2, released on August 25, 2026, which improved the security of the graph image processing.

Affected products

Formidable Charts up to 2.0.1
Formidable Forms Lite all versions (required for exploitation)
Formidable Forms Pro all versions (required for exploitation)

Timeline

2026-08-26: disclosed: CVE-2026-15990 published
2026-08-25: patched: Charts v2.0.2 released with security improvements to graph image handling

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.