Super Forms’ 13,000-site WordPress flaw is being exploited at scale despite its smaller install base

The critical Super Forms vulnerability CVE-2026-14894 was disclosed in July and patched in version 6.3.314, but September threat reporting establishes that attackers are actively exploiting it at scale. The flaw affects versions through 6.3.313 and is caused by missing file-type validation plus an unauthenticated AJAX path whose nonce can itself be obtained by an unauthenticated visitor. That can reduce exploitation to two unauthenticated requests and allow executable PHP uploads. Wordfence says exploitation began July 14 and that its firewall has blocked more than 250,000 attempts; independent security reporting has since confirmed the active-exploitation campaign.

Super Forms is far smaller than Elementor Pro, at roughly 13,000 active installations, but the exploitation volume shows why plugin popularity should not be used as a proxy for urgency. A remotely exploitable, unauthenticated file-upload path with public technical details is attractive to automated scanners regardless of whether the vulnerable population is measured in thousands or millions. For operators, the response is concrete: verify 6.3.314 or later, inspect sites that were exposed after disclosure and avoid assuming a low-profile plugin will attract low-profile attacks.

The vulnerable `submit_form` path lacks adequate file-type validation and capability checks. Although it expects a session nonce, another unauthenticated endpoint can generate the nonce and session cookie, allowing the attack to be staged without a WordPress account. A malicious executable file uploaded to a PHP-executable location can lead to full remote code execution.

The vendor released version 6.3.314 on July 8, before the public disclosure. Wordfence says exploitation started July 14, with the heaviest activity observed in mid-to-late August. Sites that did not update promptly may therefore have been exposed for weeks before the September warnings drew broad attention.

Wordfence reports more than 250,000 blocked attempts against an estimated 13,000 active installations. Those are blocked requests seen by one security vendor rather than confirmed compromises or unique attackers, but the ratio still shows that automated exploitation can hammer a comparatively small plugin ecosystem.

The Super Forms and Elementor Pro flaws both involve unauthenticated dangerous file uploads and were discussed together in some security reporting, but they are different products, CVEs, exploit paths and patch versions. Operators should inventory and remediate each independently rather than treating one plugin update as protection from the other.