/DISPATCH · 2026-09-07

WordPress Dual-Plugin Vulns Exploited in the Wild: Super Forms Unauthenticated File Upload Drops WebShell

Wordfence reports in-the-wild exploitation of Super Forms unauthenticated file upload CVE-2026-14894; 250,000+ attacks blocked. All-in-One WP Migration second-order SQLi CVE-2026-19949 hits 5M-class install base.

Incident Overview

Wordfence reported on 2–3 September that two WordPress plugin vulns are under active exploit. First: unauthenticated file upload in Super Forms (≤ 6.3.313), CVE-2026-14894, fixed in 6.3.314. Second: second-order SQL injection in All-in-One WP Migration and Backup (≤ 7.109, 5M+ active installs), CVE-2026-19949, fixed in 7.110 on 20 August. Elementor Pro form-upload CVE-2026-32475 was already exploited in the wild. WordPress form plugins are a bulk-attack focus.

Super Forms: Two-Request WebShell Drop

CVE-2026-14894 needs no account. Attacker fetches a nonce from another public endpoint, then finishes in two requests and writes an executable PHP file. Wordfence has blocked 250,000+ attack requests against this bug. Hunt:

Abnormal or modified PHP under wp-content/uploads since 8 July
super_submit_form in access logs
New admin accounts, persistence, and whether the initial upload already moved laterally

All-in-One WP Migration: Delayed Second-Order Trigger

CVE-2026-19949 does not fire immediately. Unauthenticated attacker plants payload via public post trackbacks that accept pings. Payload triggers later when an admin runs export then import, leaking the plugin secret key, which lets the attacker import a backup containing executable code and get RCE. Plant-and-wait hides the trail. Check trackback rows in the DB and migration logs together.

Remediation

Super Forms sites: upgrade to 6.3.314 or later now. All-in-One WP Migration sites: upgrade to 7.110 or later now. If you ran a vulnerable version, hunt with the indicators above. General advice for form plugins: disable file-upload fields you do not need, disable PHP execution in the upload dir, and rate-limit anomalous high-frequency hits on form submit endpoints at the WAF.

References

Border Cyber Group: Threat Intelligence Briefing (citing Wordfence analysis)