Summary
The Super Forms – Drag & Drop Form Builder plugin for WordPress has an unrestricted file upload vulnerability caused by missing validation of attacker-controlled file extensions. An authenticated user with Subscriber-level access or higher may be able to influence upload rules and cause executable files to be accepted, potentially enabling remote code execution through a later upload request.
The Super Forms – Drag & Drop Form Builder plugin for WordPress has an unrestricted file upload vulnerability caused by missing validation of attacker-controlled file extensions. An authenticated user with Subscriber-level access or higher may be able to influence upload rules and cause executable files to be accepted, potentially enabling remote code execution through a later upload request.
Affected context
The issue occurs in WordPress installations using affected versions of the Super Forms plugin, particularly where the super_save_form AJAX handler can be reached by a low-privileged authenticated user and form metadata can be modified. The upload workflow trusts an extensions string stored in _super_elements post meta and may subsequently expose file upload functionality without requiring authentication.
The issue occurs in WordPress installations using affected versions of the Super Forms plugin, particularly where the super_save_form AJAX handler can be reached by a low-privileged authenticated user and form metadata can be modified. The upload workflow trusts an extensions string stored in _super_elements post meta and may subsequently expose file upload functionality without requiring authentication.
Exploit preconditions
- Attack surface: WordPress AJAX handlers and the plugin's file upload functionality
- Required access: Authenticated Subscriber-level access or higher to influence
_super_elementsmetadata; the subsequent upload operation may not require authentication - Trigger point: Processing attacker-controlled form metadata followed by the
upload_filesupload routine - Why exploitation is possible: The upload routine applies an attacker-controlled extensions string as the allowed MIME type map without enforcing an independent, trusted file type policy
- Attack surface: WordPress AJAX handlers and the plugin's file upload functionality
- Required access: Authenticated Subscriber-level access or higher to influence
_super_elementsmetadata; the subsequent upload operation may not require authentication - Trigger point: Processing attacker-controlled form metadata followed by the
upload_filesupload routine - Why exploitation is possible: The upload routine applies an attacker-controlled extensions string as the allowed MIME type map without enforcing an independent, trusted file type policy
Why this happens
The vulnerability results from missing server-side file type validation in the upload_files function. Rather than deriving permitted types from a fixed, trusted policy, the function accepts extension and MIME-type information from modifiable post metadata. This behavior maps to CWE-434: Unrestricted Upload of File with Dangerous Type, because an attacker may cause the application to accept file types that can be interpreted or executed by the server.
The vulnerability results from missing server-side file type validation in the upload_files function. Rather than deriving permitted types from a fixed, trusted policy, the function accepts extension and MIME-type information from modifiable post metadata. This behavior maps to CWE-434: Unrestricted Upload of File with Dangerous Type, because an attacker may cause the application to accept file types that can be interpreted or executed by the server.
Potential impact
- An attacker may upload executable or otherwise dangerous files
- The web server may execute uploaded content, depending on hosting configuration
- The WordPress installation could be compromised
- Website content, credentials, or connected services could be exposed
- Attackers could use the compromised site for persistence or further attacks
- An attacker may upload executable or otherwise dangerous files
- The web server may execute uploaded content, depending on hosting configuration
- The WordPress installation could be compromised
- Website content, credentials, or connected services could be exposed
- Attackers could use the compromised site for persistence or further attacks
General mitigation guidance
Mitigation generally focuses on enforcing a trusted, server-side upload policy rather than relying on client input or mutable post metadata.
Common defensive patterns include:
- Allowing only a narrowly defined set of required file types
- Validating extensions, MIME types, file signatures, and content independently
- Rejecting executable formats regardless of attacker-controlled metadata
- Storing uploads outside executable web roots where feasible
- Applying non-executable permissions and restrictive server handling to upload directories
- Requiring capability checks and nonce validation for metadata-changing AJAX actions
- Limiting upload and file-management privileges according to least privilege
- Separating upload processing from application execution contexts
Mitigation generally focuses on enforcing a trusted, server-side upload policy rather than relying on client input or mutable post metadata.
Common defensive patterns include:
- Allowing only a narrowly defined set of required file types
- Validating extensions, MIME types, file signatures, and content independently
- Rejecting executable formats regardless of attacker-controlled metadata
- Storing uploads outside executable web roots where feasible
- Applying non-executable permissions and restrictive server handling to upload directories
- Requiring capability checks and nonce validation for metadata-changing AJAX actions
- Limiting upload and file-management privileges according to least privilege
- Separating upload processing from application execution contexts
How teams detect issues like this
Organizations can identify similar weaknesses through:
- Static analysis rules for upload handlers that derive allowed types from request data or mutable metadata
- Code review checks for missing capability and nonce validation on AJAX actions
- Tests that attempt to submit disallowed extensions, MIME types, and file signatures
- Web-server monitoring for executable files appearing in upload directories
- Policy enforcement requiring centralized allowlists and non-executable upload storage
- Automated security review tools that flag unrestricted upload patterns and missing authorization checks
Organizations can identify similar weaknesses through:
- Static analysis rules for upload handlers that derive allowed types from request data or mutable metadata
- Code review checks for missing capability and nonce validation on AJAX actions
- Tests that attempt to submit disallowed extensions, MIME types, and file signatures
- Web-server monitoring for executable files appearing in upload directories
- Policy enforcement requiring centralized allowlists and non-executable upload storage
- Automated security review tools that flag unrestricted upload patterns and missing authorization checks
