Super Forms EUVD-2026-94737

Exploitation requires two chained conditions: (1) an authenticated Subscriber-level (or higher) account, used to invoke the super_save_form AJAX handler which lacks capability and nonce checks, to poison the _super_elements post meta with an attacker-chosen extensions string; and (2) a subsequent call to the super_upload_files endpoint, which performs the upload with NO authentication and applies the poisoned extensions string verbatim as its allowed MIME-type map, bypassing file-type validation. The key limiting factor is obtaining the initial Subscriber account - trivial on sites with open user registration, harder on sites that disable self-registration. Affects all versions up to and including 6.3.316; a non-default role restriction or disabled registration reduces, but does not eliminate, exposure.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is consistent with the description: network-reachable, low-complexity, and requiring only Subscriber-level privileges (PR:L) because the full chain depends on first poisoning the _super_elements post meta via super_save_form, which demands authentication. The CWE-434 unrestricted file upload culminates in remote code execution, justifying the H/H/H impact. No EPSS score, KEV listing, or public exploit was provided, so exploitation likelihood cannot be quantified from the inputs and must be treated as unknown rather than low. The practical risk driver is that Subscriber is the lowest meaningful authenticated role and is self-registerable on any WordPress site with open registration; the second stage (super_upload_files) requires no authentication at all. Net: a legitimately dangerous, easily reached RCE on affected installs, with the main uncertainty being real-world exploitation volume rather than technical validity.

An attacker registers (or obtains) a Subscriber-level account on a WordPress site running Super Forms ≤6.3.316, then calls the super_save_form AJAX handler - which lacks capability and nonce checks - to write an attacker-controlled extensions string into the _super_elements post meta. They then invoke the unauthenticated super_upload_files endpoint, which trusts that poisoned MIME/extension map verbatim, to upload a PHP web shell and achieve remote code execution. No public exploit code was identified in the provided data, but the patch pull request (RensTillmann/super-forms #205) discloses the vulnerable code path.