CVE-2026-14894

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

No known exploitation. EPSS puts it in the 92nd percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile92nd5.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-07-10Updated 2026-07-10Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you use “Super Forms – Drag & Drop Form Builder” in WordPress and confirm the plugin version is 6.3.313 or lower.
If you are on 6.3.313 or lower, remove the plugin or disable the form submission feature immediately until you can get a safe version.
Contact your WordPress/plugin vendor or IT support to obtain the patched version (a fixed upgrade version was not identified in the available patch information).
If you cannot update right away, restrict access to WordPress admin endpoints and any publicly reachable form submission/upload paths using your web server/WAF, and monitor for new or unexpected uploaded files.
Assume active probing is happening and review your site for signs of compromise (recent file changes, new admin users, suspicious files in upload folders).

May need vendor or contractor work

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.

In plain language

Written by AI from the record

Super Forms – Drag & Drop Form Builder (up to 6.3.313) has a flaw that lets an unauthenticated person upload files to your WordPress site, which can lead to a full site takeover—this is serious enough that you should act now.

CVE-2026-14894 is an unauthenticated arbitrary file upload in Super Forms – Drag & Drop Form Builder (submit_form nopriv AJAX handler), where missing file-type checks and no permission check allow attackers to upload attacker-controlled files; exploitation is facilitated by an unauthenticated nonce/session minting flow.

If you're affected

Full website takeover
Malware or backdoor installation
Customer data theft
Site disruption or downtime

What is it

Imagine a website form that’s supposed to accept only safe information—but instead, an attacker can trick it into accepting files. In this case, someone can upload files to your site without needing an account, and those files could be made to run, giving attackers control. That can lead to malware, stolen data, or the site being taken offline.

Who is affected

This matters if you run WordPress and have the plugin “Super Forms – Drag & Drop Form Builder” installed at version 6.3.313 or earlier. Because the flaw is reachable without logging in, you do not need to have staff accounts exposed for the attack to work.

Only a risk if the vulnerable plugin version is installed and the affected form submission/upload functionality is reachable (publicly accessible endpoints).

How urgent is it

This is RED because the vulnerability is being exploited and can allow unauthenticated attackers to upload files that may be executable, which can quickly escalate to site takeover. There’s no confirmed official fix version available in the available patch information, so you should treat this as an urgent containment and upgrade task rather than a wait-and-see issue.

What to do — in detail

Confirm exposure (version and use)

In WordPress, go to the Plugins page and locate “Super Forms – Drag & Drop Form Builder”.
Note the installed version. If it is 6.3.313 or lower, you are in scope.

Contain immediately (if in scope)

Disable the plugin and/or remove it temporarily if you can. If you must keep it running, disable the affected form submission/upload functionality where possible.
Restrict access to any WordPress endpoints related to form submission/upload if your setup allows it (for example, block public access to the specific AJAX endpoints). If you use a WAF/CDN, add/enable rules to block suspicious upload/form-submission patterns.

Get the fixed version

The available patch information did not identify a fixed/upgrade version for this CVE. Contact your plugin vendor/IT provider and request the exact fixed release for Super Forms – Drag & Drop Form Builder addressing CVE-2026-14894.
If a fixed version is provided, plan the upgrade to that version on a staging environment first, then roll out to production.

If you cannot upgrade immediately (temporary workaround)

Use server/WAF controls to reduce exposure from the public internet to the vulnerable upload path(s).
Apply strict web-access controls around the form submission/upload features so they are not broadly reachable.
Search for unusual new files in WordPress upload-related directories and check for recently modified plugin/theme files.

Monitor for compromise indicators (ongoing)

Look for new admin users, unexpected changes to core/plugin/theme files, and new executable/suspicious files in upload directories.
Check server logs for repeated requests to form submission/upload-related endpoints coming from unusual IPs.

Due date and references

KEV did not list this CVE, so no CISA KEV-driven due date is available from the provided findings.

Technical context

Severity and type: Rated critical (CVSS 9.8) for unauthenticated arbitrary file upload (CWE-434) in Super Forms – Drag & Drop Form Builder. The submit_form nopriv AJAX handler lacks capability checks and does not validate uploaded file types, enabling uploads that may be executable.

Mechanism / trigger: Exploitation is described as possible via a 'data' parameter to submit_form. The barrier is a session nonce, but a separate unauthenticated nopriv AJAX action can mint a valid sf_nonce and session cookie in a prior request, enabling exploitation with only two unauthenticated HTTP requests.

Exploit/exposure status: KEV is not listed, but exploitation-related press attention is rising and an exploit/weaponization finding indicates active attention (detection template only). The traffic-light verdict for this CVE is RED, meaning the risk is treated as actively high.

Predicted likelihood: EPSS is provided as 5.3% (92th percentile) with a flat trend, but this is a prediction and not a substitute for a confirmed fixed release.

KEV meaning here: KEV (CISA) was checked and does not include this CVE based on the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS92nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

5.1% chance of exploitation activity in the next 30 days, which ranks it in the 92nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 29 days, from the signal feeds we watch.

2026-08-08Nuclei check added
2026-07-10Publishedweakness classified, att&ck mapped, record updated

Affected products

WebRehab
- Super Forms – Drag & Drop Form Builder

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable