criticalCVE-2026-14894CVSS 9.8
WordPress Super Forms <= 6.3.313 - Arbitrary File Upload
Could your systems be exposed to this vulnerability?
Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submit_form nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires no authentication due to nonce bypass.
Enter a domain or public IP you own. We'll check for signs of exposure. No signup required.
Recommended remediation
Update to the latest version of Super Forms – Drag & Drop Form Builder plugin.
Tags
cvecve2026wordpresswp-pluginwpfile-uploadrceintrusivevkev