Executive brief
The Super Forms plugin for WordPress, used to create custom contact and data entry forms, contains a critical security flaw that allows unauthorized users to upload files to the server. By exploiting this, an attacker can upload and run malicious scripts, potentially taking full control of the website and its data. This issue affects all versions of the plugin up to 6.3.313 and can be triggered with just two simple web requests.
Technical details
The Super Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a lack of capability checks on the 'submit_form' nopriv AJAX handler. While the handler requires a session nonce, this protection is bypassed because the 'super_create_nonce' endpoint allows unauthenticated visitors to generate a valid nonce and session cookie. An attacker can use these credentials to upload executable files (such as PHP scripts) to the server. This vulnerability allows for full remote code execution (RCE) and was addressed in version 6.3.314 by implementing strict file extension enforcement, PDF byte verification, and path containment.
Affected products
- WebRehab Super Forms – Drag & Drop Form Builder up to, and including, 6.3.313
Timeline
- 2026-07-10: advisory: NVD and Wordfence published the vulnerability details.
- 2026-07-10: patched: Fixed in version 6.3.314 via GitHub commit c5838f5.