- The Mess: A critical bug in the Super Forms WordPress plugin lets unauthenticated attackers upload executable PHP files straight onto a website. Wordfence has already blocked more than 250,000 exploitation attempts.
CVE-2026-14894 carries a CVSS score of 9.8 and affects Super Forms – Drag & Drop Form Builder versions up to and including 6.3.313. The fixed release is 6.3.314. The plugin has an estimated 13,000 active installations.
The problem sits in the plugin’s submit_form() functionality. The unauthenticated AJAX handler accepts uploaded data, decodes attacker-controlled content and writes it to disk without properly validating the file type or extension.
That turns a seemingly harmless form upload into a server-side execution primitive.
- The Damage: An attacker does not need a WordPress account, administrator credentials or user interaction. A PHP webshell can be written to the server and then used to create admin accounts, upload additional malware, steal data or take complete control of the WordPress installation.
The nonce does not save the site either.
Super Forms exposes another unauthenticated AJAX action that allows a visitor to obtain the required session nonce. In practice, exploitation can be reduced to two unauthenticated HTTP requests: obtain a valid nonce, then abuse super_submit_form to write the malicious file.
Attackers are already doing exactly that.
Wordfence says exploitation started on July 14, 2026, only days after the vulnerability was publicly disclosed. Its firewall has since blocked more than 250,000 attempts. The security company also observed a major spike between August 18 and August 25.
Observed attacks have used a PHP uploader disguised as an image. The request supplies a fake image MIME type while the decoded content is actually PHP. The attacker-controlled filename can end in .php, allowing the resulting file to execute when accessed through the web server.
One observed payload was named Mushr00w_upl.php. Wordfence says this uploader can subsequently be used to place additional shells, phishing kits, spam files or other malicious code on the compromised site.
There is another nasty detail: the vulnerable code also accepts an attacker-controlled destination filename, creating additional opportunities for abuse, including path traversal and overwriting writable files.
This is not a theoretical CVE sitting quietly in a database.
The exploit traffic is already hitting WordPress sites at scale. One IP address alone generated more than 106,000 blocked requests according to Wordfence, while another exceeded 82,000.
- The Fix: Update Super Forms to 6.3.314 or later immediately, then inspect the entire WordPress installation for unexpected or recently modified PHP files and review web-server logs for suspicious requests targeting
admin-ajax.phpwithsuper_submit_form.
If the vulnerable version was exposed to the internet, do not stop at the update.
A patch closes the door. It does not remove whatever walked through it.
Look for unknown administrator accounts, strange PHP files, recently modified files in writable directories and suspicious outbound connections. The presence of Mushr00w_upl.php is a particularly strong indicator, although attackers can obviously rename their payloads.
Bugstoday’s Take
WordPress security keeps producing the same ugly pattern: a plugin accepts files, someone forgets that attackers can also submit files, and suddenly a form builder becomes a remote shell delivery system.
CVE-2026-14894 is particularly nasty because there is no authentication barrier to break. The attacker just needs a vulnerable plugin and a public-facing target.
250,000 blocked attempts is the part administrators should remember.
The internet already knows about this bug.
If your server does too, you are late.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Wordfence Threat Intelligence — CVE-2026-14894
CVE — CVE-2026-14894
NVD — CVE-2026-14894
GitHub Advisory Database — GHSA-f5f5-22mx-8h54
WordPress Plugin — Super Forms – Drag & Drop Form Builder
