# Super Forms’ 13,000-site WordPress flaw is being exploited at scale despite its smaller install base Attackers are actively exploiting CVE-2026-14894 in Super Forms, a WordPress form-builder with about 13,000 active installations. The unauthenticated upload flaw can place executable PHP on vulnerable servers; version 6.3.314 contains the fix. This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base. - Status: Active - Published: 2026-09-09T20:33:30+12:00 - Updated: 2026-09-09T20:33:30+12:00 - Categories: Web Development, WordPress - Tags: CVE-2026-14894, cybersecurity, remote code execution, Super Forms - Canonical HTML: https://beyondthe.news/dossiers/super-forms-cve-2026-14894-active-exploitation-file-upload-rce ## What changed The critical Super Forms vulnerability CVE-2026-14894 was disclosed in July and patched in version 6.3.314, but September threat reporting establishes that attackers are actively exploiting it at scale. The flaw affects versions through 6.3.313 and is caused by missing file-type validation plus an unauthenticated AJAX path whose nonce can itself be obtained by an unauthenticated visitor. That can reduce exploitation to two unauthenticated requests and allow executable PHP uploads. Wordfence says exploitation began July 14 and that its firewall has blocked more than 250,000 attempts; independent security reporting has since confirmed the active-exploitation campaign. ## Why it matters Super Forms is far smaller than Elementor Pro, at roughly 13,000 active installations, but the exploitation volume shows why plugin popularity should not be used as a proxy for urgency. A remotely exploitable, unauthenticated file-upload path with public technical details is attractive to automated scanners regardless of whether the vulnerable population is measured in thousands or millions. For operators, the response is concrete: verify 6.3.314 or later, inspect sites that were exposed after disclosure and avoid assuming a low-profile plugin will attract low-profile attacks. ## The exploit path does not require an authenticated WordPress user The vulnerable `submit_form` path lacks adequate file-type validation and capability checks. Although it expects a session nonce, another unauthenticated endpoint can generate the nonce and session cookie, allowing the attack to be staged without a WordPress account. A malicious executable file uploaded to a PHP-executable location can lead to full remote code execution. ## The patch predates the heaviest public exploitation reports The vendor released version 6.3.314 on July 8, before the public disclosure. Wordfence says exploitation started July 14, with the heaviest activity observed in mid-to-late August. Sites that did not update promptly may therefore have been exposed for weeks before the September warnings drew broad attention. ## Attack volume is large relative to the installed base Wordfence reports more than 250,000 blocked attempts against an estimated 13,000 active installations. Those are blocked requests seen by one security vendor rather than confirmed compromises or unique attackers, but the ratio still shows that automated exploitation can hammer a comparatively small plugin ecosystem. ## Treat the event separately from the Elementor Pro campaign The Super Forms and Elementor Pro flaws both involve unauthenticated dangerous file uploads and were discussed together in some security reporting, but they are different products, CVEs, exploit paths and patch versions. Operators should inventory and remediate each independently rather than treating one plugin update as protection from the other. ## Key details - The vulnerability is CVE-2026-14894 with CVSS 9.8. - Super Forms versions through 6.3.313 are affected. - Version 6.3.314 is the patched release. - The flaw permits unauthenticated arbitrary file upload and can lead to remote code execution. - The nonce barrier can be obtained through a separate unauthenticated endpoint, reducing exploitation to two unauthenticated requests. - Super Forms has an estimated 13,000 active installations. - Wordfence says exploitation began July 14, 2026. - Wordfence reports more than 250,000 blocked exploit attempts. - Public proof-of-concept/scanner material became available before the September active-exploitation advisory. ## Builder takeaways - Update Super Forms to 6.3.314 or later anywhere it remains installed. - If a site stayed on an affected version after mid-July, inspect for unexpected PHP files, new administrators, modified plugins/themes and suspicious AJAX requests rather than assuming an update alone is sufficient. - Remove unused form plugins entirely; dormant code remains an attack surface even when no administrator is actively using it. - Use plugin inventory and vulnerability monitoring across every WordPress property, including low-traffic microsites and old client sites. - Do not prioritize patching solely by install-count popularity; exploitability, authentication requirements and public exploit availability can matter more than ecosystem size. ## What to watch - Additional indicators of compromise or post-exploitation payloads linked to the campaign. - Whether national exploited-vulnerability catalogs formally add CVE-2026-14894. - Updated telemetry showing how much of the installed base remains vulnerable. - Any follow-up hardening or security-process changes from the Super Forms project. ## Uncertainties - Wordfence’s 250,000-attempt figure represents firewall telemetry, not unique attackers or successful compromises. - The estimated 13,000-install figure is an ecosystem estimate and may not capture every commercial/private installation. - A vulnerable plugin version does not guarantee successful code execution if the server prevents PHP execution from the upload location, but the arbitrary upload remains critical. ## Sources - [Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin](https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/) — Wordfence · primary security telemetry · 2026-09-03T00:00:00+12:00. Primary exploitation timeline, attempt count, install estimate and patched-version guidance. - [CVE-2026-14894 vulnerability record](https://www.cve.org/CVERecord?id=CVE-2026-14894) — CVE / Wordfence CNA · primary vulnerability record · 2026-07-10T00:00:00+12:00. Canonical affected-version, weakness and technical exploit-path record. - [Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws](https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html) — The Hacker News · independent security reporting · 2026-09-04T00:00:00+12:00. Independent confirmation of active exploitation and context distinguishing the two plugin campaigns.