CVE-2026-14894: CWE-434 Unrestricted Upload of File with Dangerous Type in WebRehab Super Forms – Drag & Drop Form Builder
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.
AI Analysis
Technical Summary
CVE-2026-14894 affects the Super Forms – Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.313. The vulnerability arises from the submit_form AJAX handler lacking file type validation and any capability checks, combined with a nopriv AJAX action (super_create_nonce) that allows unauthenticated users to generate valid nonces and session cookies. This chain enables unauthenticated attackers to upload arbitrary files, potentially executable, leading to remote code execution. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An unauthenticated attacker can upload arbitrary files, including potentially executable ones, to a vulnerable WordPress site using the Super Forms plugin. This can lead to remote code execution, compromising the server and potentially the entire site. The vulnerability allows full compromise without any authentication or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX endpoints if possible, and consider disabling the Super Forms plugin or removing it from publicly accessible sites. Monitor vendor channels for updates and apply patches promptly once available.
CVE-2026-14894: CWE-434 Unrestricted Upload of File with Dangerous Type in WebRehab Super Forms – Drag & Drop Form Builder
Description
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.
CVSS v3.1
Score 9.8critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14894 affects the Super Forms – Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.313. The vulnerability arises from the submit_form AJAX handler lacking file type validation and any capability checks, combined with a nopriv AJAX action (super_create_nonce) that allows unauthenticated users to generate valid nonces and session cookies. This chain enables unauthenticated attackers to upload arbitrary files, potentially executable, leading to remote code execution. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An unauthenticated attacker can upload arbitrary files, including potentially executable ones, to a vulnerable WordPress site using the Super Forms plugin. This can lead to remote code execution, compromising the server and potentially the entire site. The vulnerability allows full compromise without any authentication or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX endpoints if possible, and consider disabling the Super Forms plugin or removing it from publicly accessible sites. Monitor vendor channels for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-06T18:28:42.679Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a506b8268715ace43e9d6e4
Added to database: 07/10/2026, 03:48:18 UTC
Last enriched: 07/17/2026, 09:51:32 UTC
Last updated: 08/23/2026, 10:52:07 UTC
Views: 236
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.