Unauthenticated arbitrary file upload via submit_form AJAX handler in Super Forms WordPress plugin (CVE-2026-14894)
Wordfence reported on 2026-09-03 that attackers are actively exploiting this flaw, so any site still running 6.3.313 or earlier can have a PHP backdoor dropped by an unauthenticated visitor.
The plugin's nopriv submit_form AJAX handler performs no file type validation and no capability check, and the only barrier — a session nonce — can be fetched by any visitor from a separate nopriv endpoint. An unauthenticated attacker can upload executable files such as PHP webshells and execute code on the web server.
Affected: Super Forms – Drag & Drop Form Builder (WordPress plugin) <= 6.3.313
How to Test
In the WordPress admin Plugins page, check the installed Super Forms version; anything at or below 6.3.313 is vulnerable. Review web server access logs for unauthenticated POST requests to admin-ajax.php invoking the submit_form action, particularly requests carrying file attachments, and inspect the site's upload directories for recently created .php or other executable files that form submissions should not produce.
How to Patch
Update Super Forms to 6.3.314 or later, which Patchstack lists as the patched release. If you cannot update immediately, deactivate the plugin until you can. Updating only closes the entry point — if logs show prior exploitation, remove any uploaded webshells and treat the site as compromised.