CVE-2026-14894: Super Forms WordPress Plugin RCE Vulnerability

CVE-2026-14894 Overview

CVE-2026-14894 is an unauthenticated arbitrary file upload vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress. All versions up to and including 6.3.313 are affected. The flaw exists in the submit_form function, which lacks file type validation and skips capability checks on the nopriv AJAX handler. A companion super_create_noncenopriv action lets any visitor mint a valid sf_nonce and session cookie on demand, collapsing the only remaining barrier. Exploitation requires two unauthenticated HTTP requests and can result in remote code execution on the target site. The issue is tracked under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated attackers can upload executable files and achieve remote code execution on affected WordPress sites in two HTTP requests.

Affected Products

• Super Forms – Drag & Drop Form Builder plugin for WordPress, all versions ≤ 6.3.313
• WordPress sites exposing the plugin's admin-ajax.phpnopriv endpoints
• Fixed in Super Forms version 6.3.314

Discovery Timeline

• 2026-07-10 - CVE-2026-14894 published to NVD
• 2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-14894

Vulnerability Analysis

The Super Forms plugin registers the submit_form handler under the wp_ajax_nopriv_ hook, exposing it to unauthenticated visitors through admin-ajax.php. The handler processes multipart form submissions, including file attachments, without validating the uploaded MIME type or extension against an allowlist. Because no capability check is enforced, any caller who satisfies the nonce check can drop files into the WordPress uploads directory. Attackers can stage PHP or other executable payloads and invoke them directly through the web server, yielding remote code execution in the WordPress context.

Root Cause

The root cause is a combination of missing input validation and a self-defeating access control design. The submit_form path does not enforce file type restrictions [CWE-434], and the sibling super_create_noncenopriv AJAX action issues a fresh sf_nonce and session cookie to any anonymous requester. The nonce therefore functions as a CSRF token rather than an authentication or authorization control, providing no meaningful barrier to abuse.

Attack Vector

Exploitation proceeds over the network with no user interaction. The attacker first calls the super_create_noncenopriv endpoint to obtain a valid sf_nonce and matching session cookie. The attacker then submits a crafted multipart request to the submit_form action carrying an executable payload, for example a PHP webshell. The uploaded file lands in a web-accessible directory and can be executed through a direct HTTP GET request.

// Vendor patch excerpt from includes/class-ajax.php (v6.3.314)
// Rejects PDF-style data URI uploads when PDF generation is not enabled
if(isset($value['datauristring'])){
+    if ( empty( $settings['_pdf']['generate'] ) || $settings['_pdf']['generate'] !== 'true' ) {
+        unset( $data[ $k ]['files'][ $key ]['datauristring'] );
+        continue;
+    }
     try {
         $imgData = str_replace( ' ', '+', $value['datauristring']);
         unset($value['datauristring']);

Source: Super Forms security commit c5838f5

Detection Methods for CVE-2026-14894

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php with action=super_create_nonce from unauthenticated clients, immediately followed by an action=submit_form request from the same source.
• New files with executable extensions (.php, .phtml, .phar) or double extensions (.jpg.php) appearing under wp-content/uploads/ after form submissions.
• Outbound connections or shell command execution originating from the PHP-FPM or web server process shortly after Super Forms activity.

Detection Strategies

• Alert on admin-ajax.php requests containing super_create_nonce and submit_form actions issued from the same IP within a short window.
• Inspect multipart uploads to Super Forms endpoints for MIME types or extensions outside expected document and image formats.
• Correlate file creation events under wp-content/uploads/ with subsequent GET requests to the same file paths that return non-static content types.

Monitoring Recommendations

• Enable WordPress access and PHP error logging, and forward both to a central log platform for retention and search.
• Monitor plugin inventories to identify sites running Super Forms ≤ 6.3.313 and prioritize them for patching.
• Track process lineage on web servers to catch php or sh children spawning from httpd or php-fpm following Super Forms uploads.

How to Mitigate CVE-2026-14894

Immediate Actions Required

• Update the Super Forms – Drag & Drop Form Builder plugin to version 6.3.314 or later on every affected WordPress site.
• Audit wp-content/uploads/ for unexpected PHP or script files and remove any confirmed webshells.
• Rotate WordPress administrator credentials, secret keys in wp-config.php, and any API tokens accessible from the site if compromise is suspected.

Patch Information

The vendor released Super Forms 6.3.314 which hardens form file-upload handling. The fix is delivered in commit c5838f5 and rejects data URI file payloads unless the form has PDF generation enabled. See the Wordfence Vulnerability Report for additional analysis.

Workarounds

• Deactivate and remove the Super Forms plugin until the update to 6.3.314 can be applied.
• Deploy a web application firewall rule that blocks unauthenticated POSTs to admin-ajax.php with action=submit_form carrying file attachments.
• Restrict execution of PHP files inside wp-content/uploads/ at the web server level to neutralize dropped payloads.

# Nginx: deny PHP execution under wp-content/uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}