Super Forms Vulnerability Exploited in the Wild: 13,000 Sites Face 9.8 CVSS Remote Code Execution
Do Son 
TL;DR
Attackers are exploiting CVE-2026-14894 in the wild. This critical Super Forms vulnerability lets unauthenticated users upload PHP files. That path leads straight to remote code execution and full site takeover. Wordfence rates it 9.8 CVSS and has blocked over 250,000 exploit attempts.
- CVE: CVE-2026-14894
- CVSS: 9.8 (Critical · CVSSv3)
- Product: WebRehab Super Forms – Drag & Drop Form Builder
- Affected: ≤ 6.3.313
- Impact: Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
- Status: Exploited in the wild
- EPSS: 0.7% (30-day)
- Action: See vendor advisory
Why It Matters
Super Forms is a drag-and-drop form builder for WordPress. Wordfence estimates around 13,000 active installations. Therefore, a pre-auth flaw exposes thousands of sites to takeover.
This Super Forms vulnerability needs no login and no user interaction. A successful attacker plants a webshell and runs commands. From there, they can create admin accounts or steal data.
How the Attack Works
The flaw sits in the submit_form function, reachable by unauthenticated visitors. The handler skips file type validation and any capability check. As Wordfence explains, the only barrier is “a session nonce freely obtainable by unauthenticated visitors”.
That nonce check falls easily. A separate public endpoint mints a valid nonce on demand. As a result, exploitation drops to just two unauthenticated requests. The attacker then supplies a base64 payload with a .php filename, which the plugin writes to disk. This report withholds the working payload.
Attack Data
The dropped webshell often carries “Mushr00w” branding. Wordfence notes that name matches a group tied to a recent government-site defacement. Still, it cautions that “hacker attributions can be swapped out easily”.
Exploitation Status
Wordfence confirms active exploitation of this Super Forms vulnerability. Attacks began on July 14, 2026, the same day the firewall rule shipped. The firewall has since blocked more than 250,000 attempts, with a spike from August 18 to 25. Independent trackers at IONIX and Patchstack corroborate the flaw and its severity.
Affected Versions
The flaw affects all Super Forms versions up to and including 6.3.313. The vendor released the patched build, version 6.3.314, on July 8, 2026.
Patch and Mitigation Steps
Update Super Forms to 6.3.314 or later right away.
Check for Indicators of Compromise
Scan your site for unexpected or recently modified .php files dated on or after July 8, 2026. Watch for a file named Mushr00w_upl.php, a strong sign of compromise. Also review access logs for admin-ajax.php requests using the super_submit_form action. If you find planted files, remove them, delete unknown admin accounts, and hunt for backdoors.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
