Security readout for executives and security teams
Plain-English summary
A WordPress plugin used to build forms can allow an anonymous internet visitor to upload dangerous files. If those files execute on the server, the attacker could take over the website. The source bundle does not show confirmed active exploitation, but the impact and ease of attack make this urgent.
Executive priority
Treat as same-day priority for any public WordPress property using this plugin. The business risk is full website compromise, including data theft, defacement, malware hosting, and operational outage.
Technical view
Super Forms Drag & Drop Form Builder up to and including 6.3.313 lacks file type validation in submit_form and exposes a nopriv AJAX path. The nonce barrier is described as freely obtainable through another unauthenticated endpoint, making remote code execution possible through arbitrary file upload.
Likely exposure
Internet-facing WordPress sites running Super Forms Drag & Drop Form Builder versions up to and including 6.3.313 are the likely exposed systems. Sites accepting public form submissions are especially relevant.
Exploitation context
CISA KEV status is false in the bundle, and no cited source confirms active exploitation. However, the vulnerability is unauthenticated, low complexity, requires no user interaction, and is rated CVSS 9.8.
Researcher notes
Evidence supports CWE-434 arbitrary file upload with unauthenticated reachability and weak nonce protection. The bundle references a GitHub commit but does not name a fixed plugin version, so remediation status should be verified with vendor or Wordfence updates.
Mitigation direction
- Identify all WordPress sites using Super Forms.
- Check vendor and Wordfence guidance for a confirmed fixed release.
- Disable or remove the plugin until a confirmed fix is applied.
- Apply the referenced vendor fix only through trusted release channels.
- Harden upload execution controls on WordPress hosting where feasible.
Validation and detection
- Confirm installed Super Forms versions across production and staging.
- Review web logs for anomalous unauthenticated form submission activity.
- Inspect upload directories for unexpected executable files.
- Check WordPress admin users and plugin files for unauthorized changes.
- Verify remediation against vendor guidance after updating or disabling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-14894 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9WordfenceVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Vendor Notified
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c7fb16-efbb-41e9-be13-98e96c1e9100?source=cveCVE reference, Wordfence
- https://github.com/RensTillmann/super-forms/commit/c5838f5877c72b738c54ed970935c77ae6830c3aCVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.