Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.
Wordfence disclosed on July 9, 2026 a critical unauthenticated arbitrary file upload vulnerability in the Super Forms WordPress plugin, which has roughly 13,000 active installations. Unauthenticated attackers can upload arbitrary files, including PHP backdoors, to achieve remote code execution. The vendor now reports that attackers are actively exploiting the flaw in the wild.
- Unauthenticated arbitrary file upload enables PHP backdoor deployment and remote code execution.
- Plugin has an estimated 13,000 active installations, limiting but not eliminating exposure.
- Flaw was publicly disclosed on July 9, 2026 and exploitation is now observed.
- Vendors
- Wordfence
- Products
- Super Forms
From the original article
On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution.
By István Márton · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.