Attackers are actively breaking into WordPress sites that use the Super Forms plugin and can seize control of the server. The flaw, CVE-2026-14894, is a critical unauthenticated arbitrary file upload bug in Super Forms that can be used to upload PHP webshells for persistent remote control. Users are advised to update to version 6.3.314.
Why it matters: Website owners using Super Forms may already be at risk if the plugin is exposed and unpatched. Update immediately to version 6.3.314 and check for unauthorized file uploads or webshells.
SecurityWeek News
2026.09.11
100% relevant
The article reports active exploitation of a specific CVE with a named affected plugin, attack method, and remediation version, establishing a distinct vulnerability story.
← Back to all stories