A critical vulnerability in the popular Super Forms – Drag & Drop Form Builder WordPress plugin is now being actively exploited in the wild. The vulnerability allows unauthenticated attackers to upload arbitrary files to a vulnerable website, including executable PHP files that can be used to take complete control of the site.
According to Wordfence, the vulnerability affects Super Forms versions 6.3.313 and earlier. It has been assigned CVE-2026-14894 and carries a CVSS score of 9.8, making it a critical-severity security issue.
The developer released version 6.3.314 to fix the vulnerability on July 8, 2026. Wordfence publicly disclosed the issue on July 9.
The situation is concerning because attackers did not wait long after the vulnerability became public. Wordfence says it started detecting exploitation attempts on July 14, the same day its firewall rule for the vulnerability was released. Its firewall has since blocked more than 250,000 exploit attempts targeting the Super Forms vulnerability.
The security company also observed a major increase in attacks between August 18 and August 25.
Super Forms has an estimated 13,000 active installations, so a significant number of WordPress websites could potentially be exposed if administrators have not updated the plugin.
The vulnerability exists in the plugin’s submit_form() function, which handles form submissions and is accessible to unauthenticated visitors.
According to Wordfence, the vulnerable code processes a datauristring value and decodes attacker-controlled Base64 data before writing it to the server. The plugin also uses an attacker-controlled filename without properly validating the file type or extension. This means an attacker can potentially upload a file with a .php extension instead of a legitimate image or document.
The vulnerability is also dangerous because the required security nonce can be obtained by an unauthenticated visitor through another AJAX endpoint. Wordfence says exploitation can therefore be reduced to just two unauthenticated HTTP requests.
An attacker could use this to upload a PHP webshell and execute code on the server. From there, they could create administrator accounts, upload additional malware, steal data or otherwise compromise the WordPress installation.
Wordfence’s analysis of observed attacks found attackers uploading a PHP-based file uploader named Mushr00w_upl.php. The company notes that the name is associated with a hacker group that recently used another vulnerability to deface a Malaysian government website, but says this does not prove the group was responsible for these attacks.
Wordfence reports that its firewall has already blocked over 250,000 requests attempting to exploit CVE-2026-14894.
The top offending IP addresses identified by Wordfence include:
103.168.147.235with more than 106,000 blocked requests103.168.146.131with more than 82,000103.154.152.178with more than 5,000103.170.97.7with more than 3,400182.10.130.51with more than 3,000
The remaining addresses listed by Wordfence also generated thousands of blocked requests.
If you use Super Forms on a WordPress website, update it to version 6.3.314 or later immediately.
Wordfence says Premium, Care and Response customers received a firewall rule on July 14. Users of the free Wordfence plugin received the same protection 30 days later, on August 13. However, a firewall rule should not be considered a replacement for updating the vulnerable plugin. I strongly recommend updating Super Forms even if your site is already protected by Wordfence.
Website owners should also check their sites for signs of compromise if they were running a vulnerable version after July 8. Wordfence recommends looking for unexpected or recently modified PHP files and unusual files created or modified since July 8. Mushr00w_upl.php is one specific filename found in attacks, although attackers can use different names.
It also recommends checking web server logs for requests to:
/wp-admin/admin-ajax.php
with the action parameter set to:
super_submit_form
If you find evidence of a successful attack, Wordfence recommends removing unknown administrator accounts and suspicious files and checking the site for additional backdoors.
The absence of these specific indicators does not necessarily mean a site was not compromised.
Source: Wordfence Threat Intelligence and its September 2026 analysis of active exploitation. Read the Wordfence security advisory
