CVE-2026-14894 describes an arbitrary file upload vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress, affecting all versions up to and including 6.3.313. The issue stems from the submit_form AJAX handler lacking file type validation and capability checks, relying only on a session nonce that unauthenticated users can easily obtain through the super_create_nonce AJAX action. This allows attackers to upload files that may be executed on the server, potentially leading to remote code execution. The vulnerability requires only two unauthenticated HTTP requests to exploit.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable ones, to the affected WordPress site. This can lead to remote code execution, full site compromise, data theft, or further attacks on the hosting environment. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints if possible, and monitor for suspicious file uploads. Avoid using the affected plugin versions in production environments. Follow vendor updates closely for an official patch or temporary mitigation.