CVE-2026-14894

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.314

Description The Super Forms – Drag & Drop Form Builder plugin for WordPress contains an arbitrary file upload flaw that allows unauthenticated attackers to achieve remote code execution. The issue exists in the submit form() function within the submit form nopriv AJAX handler, which lacks file type validation and capability checks. Attackers can bypass the session nonce requirement by using the super create nonce nopriv AJAX action to obtain a valid sf nonce and session cookie. The exploit involves sending a base64-encoded datauristring via the data parameter to the '/wp-admin/admin-ajax.php' endpoint, which is then decoded and written to disk with an attacker-controlled filename. Over 440,000 exploit attempts have been detected, with some reports indicating more than 250,000 blocked attempts where PHP webshells, such as Mushr00w upl.php, were deployed to stage further payloads.

Recommendations Update to version 6.3.314 immediately. As a temporary mitigation, deploy a WAF rule to block file uploads to '/wp-content/uploads/' from unauthenticated requests.