Published on October 20, 2026 at 3:29 PM

The vulnerability identified as CVE-2026-14894 is a significant security concern for users of the WordPress Super Forms plugin, version 6.3.313 and earlier. This issue is critical due to its potential to allow unauthenticated attackers to upload arbitrary files, which could lead to remote code execution on affected systems.

What the vulnerability is

CVE-2026-14894 is an arbitrary file upload vulnerability. This type of vulnerability arises when an application fails to adequately validate the types of files being uploaded. In this case, the Super Forms plugin lacks proper file type validation and capability checks, particularly in the submit_form nopriv AJAX handler.

Technical details

While specific technical details such as the CVSS score, CWE number, and attack vector are not published, the vulnerability does allow for remote code execution. The exploit is facilitated by a nonce bypass, which means that attackers do not need to be authenticated to exploit this vulnerability.

Impact

The primary impact of this vulnerability is the potential for remote code execution. By exploiting the lack of file type validation, attackers can upload executable files to the server. This could allow them to execute arbitrary code, potentially leading to full control over the affected WordPress site.

Affected systems

Affected systems have not been publicly disclosed at the time of writing. However, it is known that the vulnerability affects the Super Forms – Drag & Drop Form Builder WordPress plugin version 6.3.313 and earlier.

Mitigation

The recommended remediation for this vulnerability is to update to the latest version of the Super Forms – Drag & Drop Form Builder plugin. Users should ensure they are running a version newer than 6.3.313 to protect against this exploit.

Continuous scanning and timely updates are crucial in identifying and mitigating vulnerabilities like CVE-2026-14894 before they can be exploited by attackers. Regularly updating plugins and monitoring for security advisories can significantly reduce the risk of compromise.