PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14894 WebRehab CVE debrief

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload. This vulnerability exists in all versions up to, and including, 6.3.313 due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler. The only barrier to exploitation is a session nonce that can be freely obtained by unauthenticated visitors via a separate nopriv endpoint. Furthermore, the nonce requirement can be trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request. This reduces exploitation to two unauthenticated HTTP requests, making remote code execution possible.

Vendor
WebRehab
Product
Super Forms – Drag & Drop Form Builder
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-10
Original CVE updated
2026-07-10
Advisory published
2026-07-10
Advisory updated
2026-07-10

Who should care

Administrators and users of the Super Forms – Drag & Drop Form Builder plugin for WordPress should be aware of this vulnerability and take immediate action to protect their installations. This vulnerability is particularly concerning because it allows unauthenticated attackers to potentially execute remote code, which could lead to complete control of the affected system.

Technical summary

The vulnerability in the Super Forms – Drag & Drop Form Builder plugin for WordPress is caused by a lack of file type validation and insufficient capability checks in the submit_form nopriv AJAX handler. This allows unauthenticated attackers to upload files, potentially including executable files, leading to a remote code execution vulnerability. The exploit can be carried out in two steps: first, by obtaining a valid nonce through the super_create_nonce AJAX action, and second, by using this nonce to upload a malicious file through the submit_form AJAX action.

Defensive priority

High

Recommended defensive actions

  • Immediately update the Super Forms – Drag & Drop Form Builder plugin to a version that fixes this vulnerability, if available.
  • If an update is not available, consider temporarily disabling the plugin until a fix is released.
  • Review and restrict access to the submit_form and super_create_nonce AJAX handlers, if possible.
  • Enhance monitoring for suspicious activity related to file uploads and remote code execution attempts.
  • Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.

Evidence notes

The CVE record was published on 2026-07-10T04:17:47.587Z and was last modified on 2026-07-10T15:43:30.330Z. The NVD entry is currently Deferred. The vulnerability was reported by [email protected]. Limited details are available about the specific exploits or attacks related to this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14894 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14894

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14894 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14894

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.