EUVD-2026-42779
GHSA-f5f5-22mx-8h54
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network attacker (PR:N/UI:N/AV:N) with a two-request, self-defeating-nonce path (AC:L) achieves webshell RCE, yielding full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Super Forms - Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions through 6.3.313) allows attackers to upload executable files via the nopriv submit_form AJAX handler, which lacks both file-type validation (CWE-434) and any capability check. The plugin's only guardrail is a session nonce, but the companion super_create_nonce nopriv action lets any visitor mint a valid sf_nonce and session cookie on demand, collapsing the attack to two unauthenticated HTTP requests. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial exploitability make this a high-priority patch item.
Technical ContextAI
The vulnerability lives in WordPress's admin-ajax.php nopriv AJAX mechanism, which is intended to expose selected actions to unauthenticated (logged-out) visitors. Super Forms registers submit_form as a wp_ajax_nopriv_ action to accept public form submissions, but the handler saves uploaded files without validating extension or MIME type - the CWE-434 (Unrestricted Upload of File with Dangerous Type) root cause. Because WordPress typically stores uploads under a web-accessible wp-content/uploads path, a PHP file written there can be requested directly and executed by the server. The CPE cpe:2.3:a:webrehab:super_forms_-_drag_&_drop_form_builder confirms the affected component is the webrehab/RensTillmann-authored Super Forms plugin. The nonce that should gate the action is undermined by a second nopriv action, super_create_nonce, which hands unauthenticated visitors a freshly minted valid nonce plus session cookie, so the anti-CSRF token provides no real access control here.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is published as commit c5838f5877c72b738c54ed970935c77ae6830c3a (https://github.com/RensTillmann/super-forms/commit/c5838f5877c72b738c54ed970935c77ae6830c3a), so upgrade to the first tagged release above 6.3.313 that incorporates it, verifying against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c7fb16-efbb-41e9-be13-98e96c1e9100?source=cve). Until a packaged release is confirmed, compensating controls include disabling or deactivating the Super Forms plugin if public form submissions are not business-critical (trade-off: breaks all site forms), or adding a WAF rule to block admin-ajax.php requests carrying the submit_form and super_create_nonce actions from unauthenticated clients (trade-off: may block legitimate anonymous submissions). Additionally, configure the web server to deny PHP execution within wp-content/uploads (e.g. a location/directory rule stripping handler mappings), which neutralizes uploaded webshells with minimal functional impact, and monitor the uploads directory for newly written script files.
Share
External POC / Exploit Code
Leaving vuln.today