Attackers are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, and Wordfence says its firewall has already blocked more than 250,000 attempts. The flaw affects versions 6.3.313 and earlier, can be abused without authentication, and may let attackers upload malicious PHP files and take over a site.
What Super Forms vulnerability means for WordPress sites
Super Forms is a drag-and-drop form builder with an estimated 13,000 active installations. According to Wordfence Intelligence, the issue is a critical unauthenticated arbitrary file upload bug tracked as CVE-2026-14894, with a CVSS score of 9.8. The patched release is version 6.3.314.
Wordfence says the vendor released the fixed version on July 8, 2026. The vulnerability was publicly disclosed on July 9, 2026, and attackers began exploiting it on July 14, the same day Wordfence released a firewall rule to help block known attacks.
How the attack works
The vulnerable code sits in the plugin’s form submission handling, which is reachable by unauthenticated visitors. Wordfence says the problem stems from missing file type validation and the lack of a capability check on a no-privilege AJAX handler.
In practical terms, that means an attacker can send crafted form data that causes the plugin to decode attacker-supplied content and write it directly to disk. Because the filename is also attacker-controlled, the uploaded content can be saved as a PHP file, making remote code execution possible.
Wordfence’s analysis says the nonce protection is also easy to bypass because a separate unauthenticated AJAX action can mint a valid session nonce and cookie in a single prior request. That reduces exploitation to two unauthenticated HTTP requests.
Why this is especially dangerous
Once a PHP file is written into a web-accessible location, the attacker can often invoke it directly through a browser. In the observed attacks, the uploaded file acted as a webshell or uploader that could be used to place more malicious files on the server.
That can open the door to administrator account creation, data theft, phishing pages, spam, and full site compromise. Wordfence notes that path traversal may also allow a malicious file to be written to other locations the server can access, or even overwrite existing files.
Evidence of real-world exploitation
Wordfence says it has observed active attack traffic against the vulnerability and that the heaviest exploitation occurred between August 18 and August 25, 2026. The company also highlighted a sample attack request aimed at /wp-admin/admin-ajax.php using the action=super_submit_form parameter.
In the example, the attacker supplied a base64-encoded payload disguised as an image upload and used a filename ending in .php. Wordfence said the declared image content type was not verified against the actual contents, allowing the decoded PHP code to be written to disk.
The uploaded file commonly seen in these attacks was named Mushr00w_upl.php, which Wordfence says is a strong indicator of compromise. The company cautioned that attackers may use other filenames and paths as well.
Wordfence protection and blocked attacks
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule on July 14, 2026, to protect against known exploit patterns. Sites using the free version of Wordfence received the same protection on August 13, 2026.
The company says its firewall has already blocked over 250,000 exploit attempts targeting the Super Forms flaw. It also listed the IP addresses it currently sees as the most active sources of attack traffic.
- 103.168.147.235 — over 106,000 blocked requests
- 103.168.146.131 — over 82,000 blocked requests
- 103.154.152.178 — over 5,000 blocked requests
- 103.170.97.7 — over 3,400 blocked requests
- 182.10.130.51 — over 3,000 blocked requests
- 189.4.122.140 — over 2,700 blocked requests
- 129.227.46.143 — over 2,100 blocked requests
- 64.176.209.104 — over 1,900 blocked requests
- 103.164.182.122 — over 1,700 blocked requests
- 37.9.33.62 — over 1,700 blocked requests
What site owners should do now
Wordfence urges Super Forms users to update immediately to version 6.3.314 or later. Because the vulnerability is being actively exploited, relying on firewall protection alone is not enough, especially for sites that may not yet have updated.
Site owners should also review their servers for unexpected or recently modified PHP files, especially files created or changed on or after July 8, 2026. Access logs should be checked for requests to /wp-admin/admin-ajax.php with action=super_submit_form, particularly from the IP addresses listed above.
If there are signs of compromise, Wordfence recommends removing unknown administrator accounts, deleting suspicious files, and checking for backdoors. It also notes that the absence of obvious log entries does not guarantee a site is clean.
Why this disclosure matters
Critical file upload bugs remain one of the most damaging classes of WordPress vulnerabilities because they can turn a simple form feature into a full site takeover. In this case, the exploit path is straightforward enough to be used at scale, which helps explain the volume of blocked attacks.
For WordPress administrators, the immediate takeaway is simple: patch Super Forms now, verify that the site has not been tampered with, and keep an eye on logs and file changes. The combination of active exploitation and remote code execution risk makes this one of those issues that should not wait for a maintenance window.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 4, 2026 at 1:52 am
3 views
