The Exploit Bulletin — Friday, September 4, 2026: 1 issue requires action
Friday, September 4, 2026 — 1 issue requires action. If you run none of the software below, you are done.
Affects: Super Forms
1. Unauthenticated arbitrary file upload via submit_form AJAX handler in Super Forms WordPress plugin (CVE-2026-14894)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Wordfence reported on 2026-09-03 that attackers are actively exploiting this flaw, so any site still running 6.3.313 or earlier can have a PHP backdoor dropped by an unauthenticated visitor.
The plugin's nopriv submit_form AJAX handler performs no file type validation and no capability check, and the only barrier — a session nonce — can be fetched by any visitor from a separate nopriv endpoint. An unauthenticated attacker can upload executable files such as PHP webshells and execute code on the web server.
Affected: Super Forms – Drag & Drop Form Builder (WordPress plugin) <= 6.3.313
How to Test: In the WordPress admin Plugins page, check the installed Super Forms version; anything at or below 6.3.313 is vulnerable. Review web server access logs for unauthenticated POST requests to admin-ajax.php invoking the submit_form action, particularly requests carrying file attachments, and inspect the site's upload directories for recently created .php or other executable files that form submissions should not produce.
How to Patch: Update Super Forms to 6.3.314 or later, which Patchstack lists as the patched release. If you cannot update immediately, deactivate the plugin until you can. Updating only closes the entry point — if logs show prior exploitation, remove any uploaded webshells and treat the site as compromised.
Evidence: VulnCheck KEV · Wordfence: Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin (2026-09-03) · Patchstack advisory listing 6.3.314 as the patched version · Public exploit in VulnCheck XDB · Public exploit in VulnCheck XDB
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
