Product

Super Forms – Drag & Drop Form Builder <= 6.3.313

1 brief RSS

WordPress Super Forms Plugin Arbitrary File Upload (CVE-2026-14894)

An unauthenticated arbitrary file upload vulnerability (CVE-2026-14894) exists in the Super Forms - Drag & Drop Form Builder plugin for WordPress, affecting all versions up to and including 6.3.313, allowing unauthenticated attackers to upload executable files via the `submit_form` AJAX handler, leading to remote code execution after trivial nonce bypass.

Super Forms – Drag & Drop Form Builder <= 6.3.313 wordpress plugin arbitrary-file-upload rce web-exploit

1r 2t 1c 1h ago