Security Alert Summary
The Super Forms – Drag & Drop Form Builder plugin for WordPress contains an arbitrary file upload vulnerability in the submit_form handler. Missing file type validation combined with an unauthenticated nopriv endpoint that can mint a valid nonce and session cookie allows an unauthenticated attacker to upload files that may be executable, which can lead to remote code execution.
CVE Details
- CVE ID:
CVE-2026-14894 - Affected component: Super Forms – Drag & Drop Form Builder (plugin by WebRehab)
- Affected versions: All versions up to and including 6.3.313
- Published: July 10, 2026 4:17:47 AM UTC
- Last modified: July 10, 2026 3:43:30 PM UTC
- CVSS v3.1: Base Score 9.8, Severity CRITICAL, Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No authentication required (PR:N). No user interaction required (UI:N). Network attack vector (AV:N).
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability is an arbitrary file upload in the plugin’s submit_form functionality. The submit_form nopriv AJAX handler lacks a capability check and does not validate file types before accepting uploads. A second nopriv AJAX action, super_create_nonce, allows unauthenticated visitors to obtain a valid sf_nonce and session cookie in a single request. Because the nonce can be minted without authentication, an attacker can perform a two-request sequence: first obtain the nonce and session, then call the submit_form nopriv endpoint to upload files.
Because file type validation is missing, uploaded files may be stored in a location where they could be executed by the web server. The CVE description notes that this makes remote code execution possible. The issue exists due to the combination of missing server-side file validation and the lack of an authentication or capability check on the nopriv upload handler.
How This Could Impact Your Website
In a realistic scenario, a site owner maintains a site where staff and external contributors can submit form entries. An unauthenticated attacker could use the described two-request sequence to upload a malicious file such as a web shell. If executed, that file could allow the attacker to read or modify site files, access stored data, or interrupt services.
Practical consequences include exposure of internal user data (for example email addresses), increased risk of targeted phishing or social engineering against staff or contractors, and potential site defacement or service disruption if attackers execute uploaded code. The vulnerability aligns with high confidentiality, integrity, and availability impacts reported in the CVSS data, so the risk extends beyond simple content injection to possible remote code execution.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and permissions, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual file uploads, new files in web-accessible directories, and suspicious HTTP requests.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
