Critical Super Forms WordPress Flaw Actively Exploited to Achieve Remote Code Execution

A critical unauthenticated arbitrary file-upload vulnerability (CVE-2026-14894) affects Super Forms ≤ 6.3.313 and has been actively exploited since mid-July 2026; attackers can upload PHP backdoors (observed payload: Mushr00w_upl.php) via the super_submit_form AJAX action, enabling web shells, further malware staging, data exfiltration, and persistent site takeover. Administrators should immediately update Super Forms to 6.3.314, inspect writable webroots for unexpected PHP files (especially modified on/after July 8), and review web server logs for requests to /wp-admin/admin-ajax.php?action=super_submit_form and activity from the listed source IPs.