Filtered by tag: arbitrary file upload × Clear
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-14894, CVSS 9.8) in the WordPress Super Forms plugin affects versions up to 6.3.313. Attackers can upload PHP webshells and achieve remote code execution using just two HTTP requests. The vendor patched the issue in version 6.3.314 on July 8, 2026. Active exploitation began July 14, with over 250,000 blocked attempts recorded. Users should update immediately and check for unexpected PHP files, particularly Mushr00w_upl.php.