Threat Overview
A critical arbitrary file upload vulnerability in the Super Forms — Drag & Drop Form Builder plugin allows unauthenticated remote visitors to upload executable PHP scripts directly to the hosting server’s public file directory.
Tracked under CVE-2026-5418 (and related campaign vector CVE-2026-14894), the vulnerability exists in the plugin’s front-end form submission and file-attachment processing handlers. Because contact forms and quote request wizards built with Super Forms are placed on public landing pages, automated botnets actively target these endpoints to drop persistent backdoors without requiring user authentication.
| Threat Metric | Technical Details |
|---|---|
| Severity Rating | CRITICAL (CVSS 9.8 / 10.0) |
| Vulnerability Class | Unrestricted File Upload to Remote Code Execution (CWE-434 / CWE-94) |
| Vulnerable Components | Super Forms Core Plugin (Versions ≤ 4.9.830) |
| Attack Vector | Unauthenticated multipart HTTP POST request to form submission handlers |
| Exploitation Status | Mass automated in-the-wild exploitation campaigns confirmed |
| Fixed Versions | Super Forms 4.9.831 or higher |
The Breakdown: How the Exploit Works
Super Forms allows website creators to build custom lead capture forms with drag-and-drop file upload fields for accepting documents, resumes, and project estimates.
In vulnerable versions, the form upload handler relied primarily on client-side JavaScript validation and trusted user-supplied file extensions passed in the multipart request body. When an unauthenticated visitor submitted a file, the server script failed to enforce a server-side whitelist of allowed MIME types and extensions before writing the uploaded file to disk.
An automated attacker transmits a raw HTTP POST request containing a malicious PHP script disguised with a trailing space, double extension, or uppercase extension (e.g., payload.php.pdf or shell.PHP). The plugin saves the file directly into wp-content/uploads/super-forms/ with execution rights preserved. The attacker then requests the newly created file directly through their browser, immediately gaining interactive command execution on the host server.
The Operational Risk: What an Attacker Gains
- Unauthenticated Server Takeover: Intruders gain immediate shell execution permissions under the web server daemon user account.
- Persistent Web Shell Placement: Attackers hide obfuscated PHP backdoors across media directories, ensuring long-term access even if the main plugin is later updated.
- Customer Data Exfiltration: Intruders harvest form submission databases containing proprietary customer inquiries, contact details, and uploaded private documents.
- Site Defacement & Blacklisting: Compromised domains are weaponized to host SEO spam networks, phishing landing pages, and automated crypto-mining scripts, leading to immediate Google Safe Browsing blacklisting.
Our Take in Plain English
“Every business website needs a reliable way for potential clients to get in touch and submit project files. But on dynamic WordPress setups, placing a file-upload form on your website creates a direct write pipeline into your physical server’s filesystem. When a plugin skips strict server-side validation, a routine contact form becomes a backdoor for attackers to seize control of your entire server. In a modern pre-rendered edge architecture, form submissions are routed directly to isolated serverless endpoints with zero filesystem write access.”
The Modern Architectural Remedy
- Legacy Dynamic WordPress: Accepts file uploads directly into web-accessible server directories, creating continuous exposure whenever validation logic contains edge-case oversights.
- Modern Pre-Rendered Edge Architecture: Marketing pages and forms run on immutable edge infrastructure. Uploaded documents stream directly to secure, isolated cloud storage buckets (such as Cloudflare R2 or Amazon S3) with zero server runtime to exploit.
Immediate Action Items for WordPress Operators
- Update Super Forms Immediately: Upgrade the Super Forms plugin to version 4.9.831 or higher across all active domains.
- Scan Upload Folders: Check
wp-content/uploads/super-forms/and all media subfolders for unauthorized.php,.phtml, or executable scripts. - Block Directory Execution: Add server configuration directives (Nginx or Apache
.htaccess) disallowing script execution within all upload directories. - Audit Administrator Accounts: Review the WordPress user database for unauthorized administrator accounts created during recent intrusion waves.