Check whether you run WordPress with Formidable Charts installed, and confirm that Formidable Forms Lite and Formidable Forms Pro are also installed and active.
Verify whether the folder wp-content/uploads/frm-charts/ exists on your site (it often appears after charts are rendered).
If all required components and the folder exist, assume you are exposed and contact your plugin vendor/your WordPress support team to apply the recommended fix or workaround for CVE-2026-15990.
If you can’t confirm a fixed version exists, disable Formidable Charts (and any dependent Formidable Forms components you don’t strictly need) until a patch or mitigation is available.
Review your web server and WordPress logs for unusual requests targeting the 'frm_graph' parameter, and block/monitor the offending URL patterns if possible.
The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered.
In plain language
Written by AI from the record
Formidable Charts (up to 2.0.1) lets an unauthenticated person read arbitrary files from your web server by guessing a specific request, but only if your Formidable Forms Lite/Pro + Charts setup is active and the plugin’s upload directory exists—small businesses using this setup should act soon.
CVE-2026-15990 is an unauthenticated arbitrary file read flaw in Formidable Charts via the 'frm_graph' parameter, enabling directory traversal to fetch sensitive server files without login when the required Formidable Forms Lite/Pro + Charts components are active and the wp-content/uploads/frm-charts/ directory exists.
If you're affected
Sensitive server files exposure
Customer/form data theft risk
Credentials and secrets disclosure
Compliance and privacy violations
What is it
This vulnerability is like a “read any file” mistake in a chart plugin. If a malicious person can reach the right request, they may be able to pull confidential files from your server—similar to finding a shortcut that lets someone open and copy documents that were not meant to be public.
Who is affected
This matters to you if your business website uses WordPress with the Formidable Charts plugin, and you also have Formidable Forms Lite and Formidable Forms Pro active together. It’s specifically a risk when the plugin’s uploads area (wp-content/uploads/frm-charts/) exists, which typically happens after chart images are generated.
Because it’s unauthenticated and network-reachable, it’s the most concerning case where an attacker can access the relevant plugin functionality through the internet and your site has the required components turned on.
How urgent is it
This is AMBER because the flaw allows unauthenticated attackers to read arbitrary files if the specific Formidable setup is active. Even though there’s no public exploit recorded and no KEV listing, the risk is still real for sites that have Formidable Charts + its dependent plugins enabled and the required upload directory present.
Act promptly once you confirm you match the required conditions; there is no known patch from the findings, so mitigation/disablement may be necessary.
What to do — in detail
Confirm whether you’re exposed
Identify the installed plugins: In WordPress → Plugins, confirm Formidable Charts is installed and active, and that Formidable Forms Lite and Formidable Forms Pro are also installed and active.
Check for the plugin’s chart uploads directory: verify whether wp-content/uploads/frm-charts/ exists. This directory is typically created after a chart image-format chart has been rendered.
Confirm the version: if you can, note the Formidable Charts version. This issue applies to versions up to and including 2.0.1.
Remediation path
Preferred: Upgrade to a vendor-recommended fixed version if one is provided. No fix/patch information is available in the findings, so you may need vendor guidance before you can safely upgrade.
If no fixed version is available or you can’t confirm one: disable Formidable Charts (and any dependent Formidable features you don’t need) until you can remediate. This removes the vulnerable functionality even if your site still has WordPress generally exposed.
Temporary workaround (while waiting for a patch)
Disable the vulnerable functionality by turning off Formidable Charts in WordPress.
If you must keep charts, ask your WordPress/vendor support for a mitigation recommendation specific to CVE-2026-15990 because the findings do not provide a universal workaround.
What to monitor
Look for suspicious requests in web server/WordPress logs that reference the 'frm_graph' parameter. A high volume of 404/400 or unusual parameter patterns targeting that endpoint is a strong indicator of probing.
If your hosting supports it, consider temporarily restricting/blocking access to the chart-graph request paths at the web server/WAF level while you remediate.
CISA KEV
Not listed in CISA KEV (based on the findings), so there’s no KEV-driven deadline provided here.
Technical context
Severity and exposure
The reported issue is an unauthenticated arbitrary file read (CWE-22) in Formidable Charts with a high impact on confidentiality (can read sensitive files from the web server).
Attack mechanism
The weakness is triggered via the 'frm_graph' parameter, which allows directory traversal. An attacker can send crafted requests over the network without any account and request server files outside the intended directory.
Preconditions that gate real risk
The findings state it is reachable in default configuration only when specific plugin suite components are active: Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts, and when wp-content/uploads/frm-charts/ exists (typically after an image-format chart is rendered).
Exploitation status
No public exploit code is on record (per findings).
Not in CISA KEV (per findings).
EPSS is provided as a prediction and is not treated as proof of exploitation.
Practical takeaway
Treat this as a targeted risk: if you run the full Formidable stack and the charts upload directory exists, assume an attacker can potentially pull sensitive files using crafted requests; if those conditions are not met, likelihood is reduced.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
