Super Forms CVE-2026-14894: working PoCs are now public

The popular premium plugin for putting contact and application forms on WordPress sites, "Super Forms," has a serious flaw that lets a third party who has not logged in or registered upload a malicious file and hijack the site along with its server. Tracked as CVE-2026-14894, its severity is a top-tier 9.8 out of 10.

What makes it frightening is that exploitation needs no login and no click by any user. Just by hitting the form's submission endpoint, an attacker can reach a state where they can freely run programs on the server. This is called remote code execution (RCE), among the heaviest classes of vulnerability. Affected are all versions of Super Forms 6.3.313 and earlier, and the vendor has released a fix. If your site uses Super Forms, update to the latest version right now.

What is Super Forms?

Super Forms is a premium plugin that lets you place all kinds of forms — contact, quote requests, bookings, surveys — on a WordPress site simply by dragging and dropping parts. A plugin is an add-on component that extends WordPress after the fact. Thanks to advanced features like payment integration and automated email, it has been a staple form builder sold in the tens of thousands, widely used by production agencies and individual sites.

Many form plugins include a "file upload" feature so users can attach things like resumes or images. Convenient — but if it accepts any kind of file, it can become an entry point for uploading a program file and hijacking the server, a danger that comes with this class of feature. This month's issue was in exactly that form-submission and file-receiving process. Like the flaw in the WordPress plugin UsersWP that struck a similar hole in a membership feature, the shared trait is that "gateways that accept outside input" are the ones most targeted.

What is the danger, and how far does the damage spread?

This flaw is a defect known technically as "arbitrary file upload." A form should only accept set file types such as images or PDFs, but Super Forms' submission process was in a state where it accepted files without checking their type. As a result, an attacker can upload a program file (such as a PHP file) that can run commands on the server.

Once an uploaded program runs on the server, the attacker seizes the site's admin control and can effectively do anything — deface pages, exfiltrate member and inquiry data, and use the server as a springboard to attack other sites. It does not end at "one file was placed"; the site and the server behind it are seized wholesale. The 9.8 severity reflects that the server can be taken with no special privileges and no user action.

There are almost no prerequisites for exploitation. The attacker needs no login and no registration — just crafted traffic to a public page carrying the form. If a page with Super Forms is exposed to the internet, it can be targeted indiscriminately the moment a program automatically roaming the net finds it. The combination of low attack difficulty and large spoils is what makes this flaw especially dangerous.

Who targets this hole, and what happens?

The likely exploiters are attackers who deface sites to use as springboards for fake pages or spam, and ransomware gangs that seize servers for a payout. Because it can be launched without even logging in, they automatically hunt for vulnerable Super Forms and hit every one they find. Sites left un-updated after being outsourced are prime targets.

The attack flow is astonishingly simple. The attacker uploads a malicious program file to the form's submission endpoint without logging in or registering, and runs it on the server to seize control of the site. The technical details are below, but it takes only a few requests, and no click or action by the victim is required.

As a result, the individual or business running the site may have public pages defaced or the entire customer personal data collected via forms stolen. A hijacked site can, unbeknownst to its owner, be turned into a base for phishing or malware distribution, harming visitors too. Once control is lost, recovery costs time and money, and the site's own credibility is harmed. Takeovers exploiting WordPress plugin flaws are, in reality, reported in large numbers almost every month.

A technical look at what is happening

The problem lay in how the form-submission process was built. It has one identifier assigned to it.

CVE-2026-14894: accepting files without checking their type, and allowing execution

Super Forms has a process called submit_form that accepts form submissions. It should have checked whether an attached file was a "safe type" like an image or PDF and rejected program files that can run on the server. In reality, the mechanism to validate the file type was missing, and the endpoint that invokes this submission process (the AJAX handler) also lacked a capability check to confirm the caller is allowed to act. The U.S. National Institute of Standards and Technology (NIST) classifies this as unrestricted upload of a file of a dangerous type (CWE-434).

The technique goes like this. The attacker first obtains a valid token needed for submission (a nonce, normally a single-use anti-tampering token) from another public endpoint. After that, in just two requests they can place an executable program file on the server. Because the placed file can be called and run directly from the web, the attacker's commands then run on the server. No login is needed (no privilege requirement) and no user action — the heaviest profile in the CVSS breakdown. The vendor has fixed it to properly check file type and permissions, resolving it in 6.3.314 and later.

Super Forms has repeated the same class of hole

In fact, this is not the first time Super Forms has been flagged for an arbitrary file upload hole. Back in 2021, a similar RCE that let anyone upload a program file without logging in was disclosed (affecting version 4.9.700 and earlier at the time, fixed in 4.9.703). A form's attachment feature — an "entry point that can receive executable files from outside" — is a textbook case of a spot that, with weak validation, repeatedly becomes a takeover hole.

To avoid repeating the same mistake, what matters is keeping form plugins always up to date and storing uploaded files in a place "that cannot be executed directly from the web." The more convenient the feature, the more the danger spikes when the receiving side's validation and storage design are weak. Incidents where a file-receiving feature leads to takeover keep happening across products, as with the flaw in the booking plugin LatePoint.

Affected versions and the fix

The affected range is all versions of Super Forms 6.3.313 and earlier. CVE-2026-14894 was fixed in 6.3.314, released July 7, 2026, whose release notes state it plainly: "Hardened form file-upload handling to prevent unauthorized file writes (CVE-2026-14894)." More fixes have landed since, so the version to install now is Stable 6.3.316 (July 15, 2026) or later. The vendor also ships a Beta channel for early access to new features; per the official changelog, the newest Beta is 6.4.007 (July 17, 2026). Distribution has not stopped, and development continues.

If circumstances keep you from updating immediately, stopgaps such as temporarily disabling Super Forms' file-upload feature or temporarily unpublishing the page with the form can narrow the entry points. It also helps to check whether unfamiliar files have been piling up in the server's upload folder. These only buy time, though — fundamentally, updating to the latest version is required.

Where to get the latest version

This is where most people get stuck. Super Forms was sold for years on Envato's CodeCanyon marketplace, so plenty of owners expect to log in to their CodeCanyon account and download the updated zip. But the item page is currently unreachable, and searching CodeCanyon for "super forms" does not surface the product at all. Envato has given no explicit statement that it was removed, but it is safest to assume that there is effectively no way left to receive the fixed version through CodeCanyon. Watching your CodeCanyon purchase history and waiting for an update will get you nowhere.

Official distribution is now direct from super-forms.com, on a subscription license rather than a one-time purchase. The steps: if your license is active, go to Dashboard > Updates in the WordPress admin and click "Check again" — the Super Forms update should appear as normal. If it does not, download the 6.3.316 zip from the official documentation download page and install it via Plugins > Add New > Upload Plugin. Choosing "Replace current with uploaded" keeps your existing forms and settings. If your license has lapsed, or if all you hold is an old marketplace purchase, you will need to obtain a license at super-forms.com. The old official site f4d.nl redirects to super-forms.com, so an outdated bookmark still gets you there.

This episode exposes a weakness specific to premium plugins distributed outside the official WordPress repository. Repository plugins have a single fixed distribution point, and updates arrive in the admin dashboard automatically. Premium plugin updates, by contrast, work by querying the vendor's server with a license key — so when the sales channel or distributor changes, or the license expires, the update notice itself stops appearing. A fixed version can exist while the admin screen shows nothing, leaving owners to assume "no update means nothing to do" and keep running the old build. When that happens right after a critical flaw is disclosed, it is the worst possible combination. On sites built with premium plugins, stop waiting for the dashboard notice and instead check the version number yourself and read the vendor's announcements directly.

What is confirmed and what is still unknown

What you can do right now

The direction is clear. The top priority is to update Super Forms to Stable 6.3.316 or later. If no update notice shows in the WordPress admin, searching your CodeCanyon account will not help — check your license at super-forms.com, grab the zip from the official download page, and swap it in. Because it can be exploited without authentication and PoCs are now circulating, every day of delay extends the time you spend exposed.

Before and after updating, it also helps to check whether you have already been exploited. Look in the server's upload folder (under wp-content/uploads and the like) for unfamiliar PHP files, and if present, remove them and investigate the intrusion path. If worried, consider restoring from backup or consulting a security professional. Removing unused plugins and keeping only the active ones up to date is the basis of protecting WordPress.

Frequently asked questions

In summary

This case is about how a convenient form-building plugin, by accepting files without checking their type, could let a non-logged-in third party upload a program file and hijack the site along with its server. CVE-2026-14894 is exploitable with no authentication and no user action, at a top-tier severity of 9.8. It is a staple plugin used in the tens of thousands — and the same class of hole has been struck before.

The saving grace is that the vendor has already released a fix. Updating to Stable 6.3.316 or later stops it. What changed is where you go to fetch that fix: no update arrives in a CodeCanyon account any more, and the correct entry points are direct sales at super-forms.com and its download page. The public PoCs have not yet been tied to any real attack, but with the tooling in circulation there is no reason to put the update off. For plugins with file-receiving features, it is best to treat "convenient but easily targeted" as a given and make frequent updates — and checking the upload folder — a habit. We will report again if new signs of exploitation emerge.

References

• ▸ NVD - CVE-2026-14894
• ▸ WPScan - Super Forms vulnerabilities
• ▸ Super Forms official documentation
• ▸ Super Forms v6.3.314 release notes (CVE-2026-14894 fix)
• ▸ Super Forms changelog (latest Stable / Beta)
• ▸ Super Forms official site