Threat actors are actively exploiting a critical vulnerability in the Super Forms WordPress plugin to upload PHP webshells and potentially seize full control of vulnerable websites. Wordfence said its firewall has already blocked more than 250,000 exploitation attempts.
The issue, tracked as CVE-2026-14894, affects Super Forms – Drag & Drop Form Builder versions 6.3.313 and earlier.
The vulnerability carries a CVSS score of 9.8 and allows unauthenticated attackers to upload arbitrary files, including executable PHP code, without requiring a legitimate WordPress account.
Critical Super Forms WordPress Flaw
Super Forms, which has an estimated 13,000 active installations, supports file-upload fields in website forms. Wordfence researcher Andrea Bocchetti found that the plugin’s submit_form() functionality improperly processes user-supplied file data sent through its unauthenticated AJAX handler.
The vulnerable code accepts a datauristring value, base64-decodes the supplied content, and writes it to the server’s upload directory. However, it does not adequately validate the uploaded file type, extension, or filename before saving it.
As a result, attackers can disguise a PHP payload as an image-like data URI, specify a .php filename, and cause the server to store executable code. If the uploaded file is accessible via the website, an attacker can invoke it remotely and execute commands via a webshell.
The plugin exposes a separate unauthenticated super_create_nonce action that enables any visitor to generate a valid sf_nonce and session cookie before submitting a malicious upload request.
This reduces exploitation to two unauthenticated HTTP requests: one to obtain a nonce and another to send the crafted form submission to the super_submit_form endpoint.
Successful exploitation can enable attackers to establish persistent access, upload additional malware, deploy phishing kits or spam infrastructure, create rogue administrator accounts, steal data, or overwrite files writable by the web server.
The flaw may also support path traversal, potentially allowing malicious files to be placed outside the expected upload path. Wordfence publicly disclosed the vulnerability on July 9, 2026, after Super Forms version 6.3.314 was released with a fix on July 8.
Attackers began targeting the flaw on July 14, the same day Wordfence deployed a firewall rule to Premium, Care, and Response customers. Free Wordfence users received the rule on August 13.
The most intense exploitation activity occurred between August 18 and August 25, according to the security firm. Top source IP addresses included 103.168.147.235, which generated more than 106,000 blocked requests, and 103.168.146.131, linked to more than 82,000 attempts.
Observed attacks attempted to deploy a PHP uploader called Mushr00w_upl.php. The filename is a strong indicator of compromise, although attackers can easily change filenames, payloads, and upload locations.
Administrators should immediately update Super Forms to version 6.3.314 or later. They should also inspect their WordPress installations for recently added or modified PHP files, particularly files created after July 8.
Defenders should review access logs for requests to /wp-admin/admin-ajax.php containing the action=super_submit_form parameter and investigate traffic from known offending IP addresses.
Any unknown administrator accounts, unauthorized files, webshells, or persistence mechanisms should be removed during incident response.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
