The file lands on a hacked WordPress site with a name that is easy to skim past in a directory listing: Mushr00w_upl.php. Open it in a browser and it draws a small green upload box on a black background, waiting to accept whatever the attacker wants to put on the server next. Wordfence says its firewall has now blocked more than 250,000 attempts to plant files like it through a single WordPress plugin.
The plugin is Super Forms, a drag and drop form builder with an estimated 13,000 active installations, and the flaw is CVE-2026-14894, rated 9.8 out of 10. It lets anybody who can reach the site, with no account and no password, write an executable PHP file onto the server. That is the whole game. A working PHP file on a web server means the attacker can run commands, create administrator accounts and read the database.
Two requests is all it takes
Wordfence's István Márton, in the original report, describes a submission handler with almost no guard on it. Super Forms processes form submissions through a function that unauthenticated visitors can reach, and when a submitted field carries a data URI the plugin base64 decodes the content and writes it straight to disk under a filename the sender chooses. There is no check on the file type and no check on the extension, so a request can simply declare its payload to be a GIF and name it with a .php ending.
The one apparent barrier, a session nonce, is not a barrier. A separate endpoint hands any anonymous visitor a valid nonce and session cookie on request, which reduces exploitation to two unauthenticated HTTP requests. The vulnerability was reported by the researcher andrea bocchetti, for a bounty of $33.
Patched in July, attacked since July 14
The vendor shipped the fixed release, version 6.3.314, on July 8, 2026, and Wordfence published the advisory the next day. Attackers started exploiting the issue on July 14, the same day Wordfence released a firewall rule for it, and the heaviest activity the company recorded ran from August 18 to August 25. Sites using the free version of Wordfence did not receive that rule until August 13, a thirty day gap that sat squarely inside the exploitation window.
The uploader dropped in these attacks carries Mushr00w branding, a tag used by a group that recently defaced the website of Malaysia's Health Ministry through a Joomla content editor extension flaw. Wordfence is careful to say this is not an attribution: branding inside a webshell is trivially swapped, and the file itself reads as machine generated.
Update to 6.3.314, then go looking
Update Super Forms to 6.3.314 or later. Because the attacker chooses where the file lands, checking the upload directory is not enough. Wordfence recommends reviewing the whole site for unexpected or recently modified .php files, especially anything created or changed on or after July 8, 2026, and searching for the filename Mushr00w_upl.php, which was the common choice in the attacks it observed. Then check web server access logs for requests to /wp-admin/admin-ajax.php with the action parameter set to super_submit_form, particularly from the addresses it saw most:
- 103[.]168[.]147[.]235, over 106,000 blocked requests
- 103[.]168[.]146[.]131, over 82,000 blocked requests
- 103[.]154[.]152[.]178, over 5,000 blocked requests
- 103[.]170[.]97[.]7, 182[.]10[.]130[.]51 and 189[.]4[.]122[.]140
- 129[.]227[.]46[.]143, 64[.]176[.]209[.]104, 103[.]164[.]182[.]122 and 37[.]9[.]33[.]62
An absence of matching log entries does not prove a site is clean. Where evidence does turn up, Wordfence advises removing unknown administrator accounts and unexpected files, then hunting for further backdoors: a first stage uploader is usually there to fetch the second.
Form builders keep arriving at this same destination. IntelFusions covered a near identical unauthenticated upload path in Gravity Forms at the start of September and in Forminator in August. A form that accepts attachments is a file upload feature with a friendlier name, and it earns the same scrutiny.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.