CVE-2026-14894: WordPress Super Forms Plugin Critical Arbitrary File Upload

Executive Summary

CVE-2026-14894 is a critical (CVSS 9.8) arbitrary file upload vulnerability affecting the Super Forms – Drag & Drop Form Builder plugin for WordPress. All versions up to and including 6.3.313 are vulnerable. Exploitation requires no authentication and no special privileges, making this a high-priority patch target for any site running the affected plugin.

Vulnerability Details

Technical Analysis

The vulnerability exists in the submit_form function of the Super Forms plugin. Two compounding weaknesses enable exploitation:

1. Missing file type validation — The plugin does not validate or restrict the types of files submitted through its AJAX-based form submission endpoint.
2. No capability check on the nopriv AJAX handler — The submit_form function is registered as a wp_ajax_nopriv_ action, meaning it is accessible to completely unauthenticated users without any WordPress nonce or permission check enforced at the capability level.

An attacker can craft a multipart form request targeting wp-admin/admin-ajax.php?action=submit_form and upload a PHP webshell or other malicious executable to the server's web-accessible directory. Once uploaded, the file can be requested directly, granting remote code execution (RCE) on the underlying server.

Impact

• Remote Code Execution via uploaded PHP shell
• Full server compromise if the web server runs with elevated privileges
• Data exfiltration, malware deployment, or use as a pivot point within a hosting environment
• Shared hosting risk: a compromised site may affect neighbouring domains on the same server

Affected Versions

Remediation

1. Update immediately to a patched version above 6.3.313 via the WordPress plugin dashboard or WP-CLI:

   wp plugin update super-forms

   Copy

2. Audit uploaded files — Check wp-content/uploads/ for any recently uploaded .php, .phtml, .phar, or other executable files.
3. Review server logs — Look for POST requests to wp-admin/admin-ajax.php with action=submit_form containing unexpected file parameters.
4. Implement a WAF rule to block file uploads of executable MIME types if patching is delayed.
5. Consider temporary plugin deactivation until a patch is applied if the plugin is not business-critical.

Indicators of Compromise

• Unusual POST traffic to wp-admin/admin-ajax.php?action=submit_form
• Unexpected .php files in wp-content/uploads/ subdirectories
• New admin users created after the file upload timestamp
• Outbound connections from the web server process to unknown IPs

References

• NVD Entry — CVE-2026-14894
• WordPress Plugin Repository — Super Forms