Super Forms

Wordfence reports active exploitation of CVE-2026-14894 in Super Forms <= 6.3.313, with more than 250,000 blocked attempts. Update to 6.3.314 or newer and check for unexpected PHP files, especially Mushr00w_upl.php.

Wordfence published a new active-exploitation report for CVE-2026-14894 on September 3, 2026. The vulnerability affects Super Forms – Drag & Drop Form Builder up to and including 6.3.313 and can allow unauthenticated arbitrary file upload that leads to remote code execution.

The issue is not theoretical. Wordfence reports that attackers began exploiting the vulnerability after disclosure in July and that its firewall has blocked more than 250,000 exploit attempts. Sites still running vulnerable Super Forms versions should treat this as an urgent patch-and-hunt issue.

Table of Contents

Vulnerability summary

Product: Super Forms – Drag & Drop Form Builder
Slug: super-forms
CVE: CVE-2026-14894
Affected versions: Super Forms <= 6.3.313
Fixed version: 6.3.314
Severity: CVSS 9.8 Critical according to Wordfence; Patchstack lists CVSS 10
Attack class: unrestricted upload of dangerous file type, CWE-434
Required privilege: none
User interaction: none
Active exploitation: Wordfence reports 250,000+ blocked attempts

Technical cause

The vulnerable path is in the Super Forms submission handler, specifically the file-handling branch used by submit_form() in the SUPER_Ajax class. The handler is reachable from unauthenticated submissions and can process a file field containing a datauristring value.

In affected versions, uploaded content can be base64-decoded and written to disk using an attacker-controlled filename. Missing file type validation and insufficient authorization around the unauthenticated form submission path mean a PHP-capable file can be written into a web-accessible location. Wordfence also notes that path traversal can let attackers place or overwrite files anywhere the web-server user can write.

Successful exploitation can lead to PHP code execution, administrator account creation, data theft, spam injection, phishing kit deployment, or persistent backdoors. The exact blast radius depends on filesystem permissions and whether PHP execution is blocked under upload paths.

Immediate remediation

Update Super Forms to 6.3.314 or newer immediately.
If the update cannot be applied now, disable the Super Forms plugin until the patched version is installed.
Search the entire site for unexpected or recently modified PHP files, not only the uploads directory.
Look specifically for a file named Mushr00w_upl.php, which Wordfence observed in active attacks.
Review newly created administrator users, unfamiliar plugins, unfamiliar themes, and changed application passwords.
Preserve web-server logs before cleanup if compromise is suspected.

WP-CLI checks

Use WP-CLI to confirm the installed plugin version and review the plugin inventory:

wp plugin get super-forms --fields=name,version,status
wp plugin update super-forms
wp plugin get super-forms --field=version
wp plugin list --fields=name,status,version,update

Then search for recently modified executable files. Review every hit manually before deleting anything:

find . -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -60 -print
find . -type f -name 'Mushr00w_upl.php' -print
wp core verify-checksums
wp plugin verify-checksums --all

Log review

Search access logs for Super Forms submissions and requests to suspicious PHP files. The following patterns are defensive indicators and should be correlated with timestamps, response codes, and created files:

grep -Ei 'super_submit_form|/wp-admin/admin-ajax.php|Mushr00w_upl\.php' /var/log/nginx/access.log*
grep -Ei 'super_submit_form|/wp-admin/admin-ajax.php|Mushr00w_upl\.php' /var/log/apache2/access.log*

Observed IP indicators

Wordfence listed the following high-volume IP addresses in current exploit attempts. Use these for log enrichment and short-term blocking, but do not treat IP blocking as a substitute for patching:

103.168.147.235
103.168.146.131
103.154.152.178
103.170.97.7
182.10.130.51
189.4.122.140
129.227.46.143
64.176.209.104
103.164.182.122
37.9.33.62

Temporary mitigation

The correct fix is the vendor patch. If a maintenance window is delayed, disable Super Forms or block unauthenticated requests to the Super Forms submission action at the WAF layer until the plugin is upgraded. Keep the rule scoped so unrelated WordPress AJAX traffic continues to work.

Also enforce a server-level rule that prevents PHP execution from upload directories. For NGINX:

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar|shtml)$ {
    deny all;
    return 403;
}

For Apache, add a deny rule in upload directories where overrides are honored:

<FilesMatch "\.(php|phtml|phar|shtml)$">
    Require all denied
</FilesMatch>