criticalCVE-2026-14894CVSS 9.8

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Could your systems be exposed to this vulnerability?

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submit_form nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires no authentication due to nonce bypass.

Enter a domain or public IP you own. We'll check for signs of exposure. No signup required.

No signup. No installation. Results in about a minute.

Recommended remediation

Update to the latest version of Super Forms – Drag & Drop Form Builder plugin.

Tags

cvecve2026wordpresswp-pluginwpfile-uploadrceintrusivevkev