Description

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T14:17:07.707Z",
  "pubdate": "2026-08-26T14:17:07.707Z",
  "executiveSummary": "The Formidable Charts plugin for WordPress contains a critical Directory Traversal vulnerability that allows unauthenticated attackers to retrieve sensitive arbitrary files from the underlying server filesystem.\nThis vulnerability stems from improper input validation within the 'frm_graph' parameter, which is processed by the plugin to facilitate chart rendering.\nThe flaw affects all versions of Formidable Charts up to and including 2.0.1, provided that the Formidable Forms Lite and Formidable Forms Pro plugins are also active.\nExploitation is contingent upon the existence of the 'wp-content/uploads/frm-charts/' directory, which is typically generated after an image-format chart has been rendered at least once.\nThe impact is significant, as an attacker can gain unauthorized access to configuration files, credentials, and other sensitive system or application data, potentially leading to full site compromise.\nBecause the vulnerability does not require authentication, the risk is categorized as high for any publicly accessible WordPress installation meeting the plugin configuration requirements.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient sanitization mechanism within the plugin's chart rendering logic, specifically regarding the handling of the 'frm_graph' parameter. When the application processes requests containing this parameter, it fails to adequately validate or restrict the file path input, allowing directory traversal sequences (such as '../') to escape the intended directory scope.\nThe vulnerability is reachable when the 'wp-content/uploads/frm-charts/' directory exists on the server. This directory is created programmatically by the plugin upon the initial successful rendering of an image-format chart. Consequently, the attack surface becomes available once a single chart has been generated by an authorized user or through site functionality.\nAn unauthenticated attacker can exploit this flaw by crafting a malicious HTTP request that passes a traversal string to the 'frm_graph' parameter. By manipulating the path, the attacker directs the server-side script to treat a target file outside the web root as a graph asset. The application then reads the contents of the specified file and returns it to the attacker, effectively bypassing intended access controls.\nThe attack flow proceeds as follows: 1) The attacker identifies that the target site is running the vulnerable combination of Formidable Forms Lite, Pro, and Formidable Charts. 2) The attacker confirms the presence of the 'wp-content/uploads/frm-charts/' path. 3) The attacker crafts a request using the 'frm_graph' parameter, injecting directory traversal characters (e.g., ../../../wp-config.php) to traverse the file system. 4) The application processes this input without adequate validation, accesses the requested file, and discloses the contents within the server response.\nThe exposure of arbitrary files can lead to the retrieval of sensitive information such as database credentials stored in 'wp-config.php', private cryptographic keys, or sensitive source code files. This information disclosure provides the attacker with the necessary primitives to perform further attacks, including potential remote code execution or unauthorized database access, significantly impacting the confidentiality and integrity of the entire WordPress instance."
}