CVE-2026-14894: Unauthenticated file upload in Super Forms WordPress plugin

How to Detect It

Detection should focus on two things: requests to the relevant WordPress AJAX actions and post-exploitation evidence in upload directories or web-accessible file paths. Start with web server logs for admin-ajax.php and look for requests containing either action=super_create_nonce or action=submit_form, especially when they originate from the same client within a short time window and are followed by suspicious requests for newly uploaded files.

You should also inspect the WordPress filesystem for recently created .php, .phtml, .phar, or double-extension files in upload-related directories. Because the root cause involves insufficient file type validation, look beyond obvious filenames. Attackers often use names such as image.php, invoice.php.jpg, or random alphanumeric files placed in writable locations.

Technical Notes

Example grep patterns for Apache or Nginx access logs:

grep -E 'admin-ajax\.php.*(super_create_nonce|submit_form)' /var/log/apache2/access.log
grep -E 'admin-ajax\.php.*(super_create_nonce|submit_form)' /var/log/nginx/access.log

Example pattern to find suspicious executable files under WordPress content directories:

find /var/www/html/wp-content -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -printf "%TY-%Tm-%Td %TH:%TM %p\n" | sort

A simple Splunk query for web logs:

index=web sourcetype IN (apache_access, nginx_access)
("POST /wp-admin/admin-ajax.php" AND ("action=super_create_nonce" OR "action=submit_form"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri, user_agent
| convert ctime(first_seen) ctime(last_seen)

A basic Sigma-style logic pattern defenders can translate:

title: WordPress Super Forms Suspicious AJAX Exploitation Pattern
logsource:
  category: webserver
detection:
  selection1:
    cs-uri-stem: "/wp-admin/admin-ajax.php"
    cs-uri-query|contains: "action=super_create_nonce"
  selection2:
    cs-uri-stem: "/wp-admin/admin-ajax.php"
    cs-uri-query|contains: "action=submit_form"
  condition: selection1 or selection2
level: high

Also review for follow-on requests to freshly uploaded files, sudden 200 responses on unusual PHP files under /wp-content/, and outbound connections from the web server process.

Mitigation and Patching

The primary mitigation is to upgrade Super Forms immediately to a vendor-fixed release later than 6.3.313. Based on the available evidence, versions 6.3.313 and earlier are vulnerable, and a patch exists downstream of that release. However, because the exact fixed version number is not conclusively confirmed in the retrieved advisory text, defenders should install the latest available release from the vendor or official WordPress distribution source and verify that it includes the fix associated with the referenced GitHub commit.

If you cannot patch immediately, your interim goal is to reduce exploitability and limit post-upload execution. Temporary workarounds may include disabling the plugin, restricting access to admin-ajax.php where feasible, or placing execution controls on upload directories so that even a successful upload does not execute as PHP. Be careful with blanket admin-ajax.php restrictions, as they may break legitimate site functionality. For business-critical sites, test compensating controls before rollout.

Technical Notes

Check the installed plugin version with WP-CLI:

wp plugin list | grep super-forms

Update to the latest available release:

wp plugin update super-forms

If you need to disable the plugin immediately while assessing impact:

wp plugin deactivate super-forms

A common hardening control is to block PHP execution in upload paths. For Apache, an example .htaccess control in uploads directories is:

<FilesMatch "\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>

For Nginx, a defensive location block may look like:

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
}

After patching, assume compromise is possible if the site was exposed while vulnerable. Rotate WordPress admin credentials, review newly created users, inspect scheduled tasks, compare core files and plugin directories against known-good versions, and consider restoring from a clean backup if you identify webshell activity.

References

The authoritative public source for this CVE is the NVD record, which describes the vulnerability as an unauthenticated arbitrary file upload caused by missing file type validation, absent capability checks on the submit_form nopriv AJAX handler, and a trivially bypassed nonce mechanism exposed through super_create_nonce. It also states that exploitation can be completed in two unauthenticated requests.

The NVD record also points to the upstream GitHub fix commit, which is the most relevant code-level reference for change validation, and to Wordfence ecosystem intelligence showing the affected range as Super Forms <= 6.3.313 with patch status indicated as patched. Since the exact fixed version number is not explicitly confirmed in the retrieved text, defenders should use these references to validate the current vendor release before closing remediation.

• NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-14894
• GitHub fix commit referenced by NVD: https://github.com/RensTillmann/super-forms/commit/c5838f5877c72b738c54ed970935c77ae6830c3a
• Wordfence vulnerability record: https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c7fb16-efbb-41e9-be13-98e96c1e9100?source=cve
• Wordfence plugin vulnerability page: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/super-forms
• Super Forms documentation site: https://docs.super-forms.com

For further reading on related security topics, check out our articles on what is asymmetric encryption and the man-in-the-middle attack.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.