Critical File‑Upload Validation Flaw in Super Forms Plugin (CVE‑2026‑14894) Fuels Massive Exploit Campaign
What It Is — A missing file‑type validation bug in the Super Forms – Drag & Drop Form Builder for WordPress allows unauthenticated attackers to upload arbitrary files, leading to remote code execution. The flaw is tracked as CVE‑2026‑14894 with a CVSS 9.8 rating.
Exploitability — Threat actors have launched more than 440 000 exploit attempts in the wild; public PoC scripts are circulating, confirming active exploitation.
Affected Products — Super Forms plugin (all versions prior to the vendor’s emergency patch) and Elementor Pro (related RCE issue disclosed alongside Super Forms).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party components is essential; the volume of attempts shows that unmanaged plugins become a rapid attack surface.
- Demonstrable evidence of timely patching and configuration hardening satisfies auditors looking for a defensible supply‑chain posture.
- Logging of file‑upload activity and anomaly detection provide the audit trail needed to prove due‑diligence during a security review.
Recommended Actions
- Apply the vendor‑released patches for Super Forms and Elementor Pro immediately.
- Enforce strict file‑type allow‑lists at the web‑server and application layers; block execution of uploaded files.
- Deploy a software‑composition analysis (SCA) tool to inventory WordPress plugins and receive real‑time vulnerability alerts.
- Enable detailed upload logging and integrate with a SIEM for anomaly detection.
- Review and harden your WordPress hardening checklist (disable unused plugins, enforce least‑privilege for plugin accounts).
Source: The Hacker News