Attackers are currently targeting a critical flaw in the widely used WordPress plugin “Super Forms.” In early September 2026, security vendor Wordfence reported more than 250,000 blocked exploitation attempts. Tracked as CVE-2026-14894 and rated CVSS 9.8, the vulnerability allows a complete takeover of affected websites.
The affected product is the “Super Forms – Drag & Drop Form Builder” plugin from vendor WebRehab, in all versions up to and including 6.3.313. The bug stems from missing file-type validation: through an unprotected AJAX endpoint, unauthenticated visitors can upload arbitrary files, including executable PHP scripts.
How the attack works
According to Wordfence’s analysis, attackers abuse the plugin’s “submit_form” routine: they disguise PHP code as a so-called data URI, bypass the intended security token via a separate function, and write executable files to the server. Researchers observed a compact uploader webshell named “Mushr00w_upl.php,” used to stage further malicious code. Wordfence says most of the traffic originated from a handful of IP addresses, each responsible for more than 80,000 attempts.
Affected versions and mitigations
The vendor closed the hole back on 8 July 2026 with version 6.3.314, and Wordfence published details a day later. Analysts first recorded exploitation attempts on 14 July, with the wave surging again in September. Administrators of affected sites should act without delay:
- Update to Super Forms 6.3.314 or later immediately
- Check the server for unknown PHP files and the file “Mushr00w_upl.php”
- If compromise is suspected, rotate credentials and review log files
Sources: Patchstack · GBHackers · Security Online
