The Super Forms – Drag & Drop Form Builder contains an arbitrary file upload flaw. Missing file type validation and absent capability checks on the submit_form AJAX handler allow attackers to upload files that may contain executable code. Because the nonce can be minted by unauthenticated users, an attacker can perform the upload without authentication, leading to remote code execution on the site. The weakness is categorized as CWE-434.

The flaw exists in WebRehab Super Forms – Drag & Drop Form Builder versions up to 6.3.313. No specific subversions are listed; the list covers all releases through that version.

The CVSS score is 9.8, indicating critical severity, and the EPSS score of < 1% suggests a low probability of exploitation, though not zero. The issue is not listed in CISA KEV. Exploitation requires only two unauthenticated HTTP requests: first the super_create_nonce nopriv action to obtain a valid nonce and session cookie, then the submit_form nopriv AJAX call to upload the chosen file. Because the attacker does not need to authenticate, attackers can automate the procedure across many sites. The likely vector is via web requests to the plugin’s AJAX endpoints, inferred from the description.