Threat actors are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, allowing them to upload PHP backdoors and gain remote code execution.
This flaw, tracked as CVE-2026-14894, affects Super Forms versions 6.3.313 and earlier. Administrators are urged to upgrade to version 6.3.314 immediately.
Super Forms WordPress Flaw
Wordfence disclosed this unauthenticated arbitrary file-upload issue on July 9, 2026, shortly after the patched version was released on July 8. Exploitation began on July 14, the same day Wordfence issued a firewall rule for Premium, Care, and Response customers.
The security vendor reported that its firewall has blocked over 250,000 attempts targeting this vulnerability. The risk is particularly high for publicly accessible WordPress sites that allow form submissions.
The vulnerable `submit_form()` routine processes file-upload fields submitted through an unauthenticated AJAX handler, `super_submit_form`.
A supplied data URI string is base64-decoded and written to disk. The plugin does not reliably validate the uploaded content type or extension, nor does it adequately restrict the filename for the destination path.
Although the request requires an `sf_nonce`, this protection is ineffective: unauthenticated visitors can obtain a valid nonce and session cookie through the separate `super_create_nonce` nopriv action. Consequently, exploitation can be simplified to two unauthenticated HTTP requests.
An attacker can disguise PHP code as a data URI declared as an image, select a .php filename, and trick the server into saving executable code.
Once accessible via the website, this code can function as a web shell or uploader, enabling additional malware deployment, phishing kit hosting, spam operations, data exfiltration, or persistent site takeover.
Observed payloads have included a web shell named `Mushr00w_upl.php`, a compact browser-based uploader designed to stage additional malicious files.
IOC
| Indicator | Type | Detection relevance |
|---|---|---|
Mushr00w_upl.php | File name | Observed PHP uploader; strong compromise indicator |
/wp-admin/admin-ajax.php?action=super_submit_form | Web-log pattern | Likely exploitation request |
103.168.147.235 | Source IP | More than 106,000 blocked requests |
103.168.146.131 | Source IP | More than 82,000 blocked requests |
103.154.152.178 | Source IP | More than 5,000 blocked requests |
103.170.97.7 | Source IP | More than 3,400 blocked requests |
182.10.130.51 | Source IP | More than 3,000 blocked requests |
189.4.122.140 | Source IP | More than 2,700 blocked requests |
129.227.46.143 | Source IP | More than 2,100 blocked requests |
64.176.209.104 | Source IP | More than 1,900 blocked requests |
103.164.182.122 | Source IP | More than 1,700 blocked requests |
37.9.33.62 | Source IP | More than 1,700 blocked requests |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Site owners should upgrade Super Forms to version 6.3.314 without delay. Defenders are advised to search for unexpected or recently modified PHP files within the writable webroot, particularly those created or altered on or after July 8.
Security teams should review web server logs for requests to `/wp-admin/admin-ajax.php` with the action parameter set to `super_submit_form`, especially those originating from the listed IP addresses. Relying solely on IP blocking is insufficient since attackers can easily rotate their infrastructure.
If a compromise is suspected, site owners should isolate the site, remove unauthorized administrator accounts and unfamiliar PHP files, rotate WordPress and hosting credentials, inspect scheduled tasks and plugins for persistence, and restore only from a verified clean backup.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
