Super Forms WordPress Plugin Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing arbitrary file upload has been identified in the Super Forms – Drag & Drop Form Builder plugin for WordPress, affecting all versions prior to 6.3.314. The issue arises in the submit_form function, where there is a lack of proper file type validation and capability checks on the submit_form nopriv AJAX handler. This handler's only protection is a session nonce, which can be easily obtained by unauthenticated users through a separate nopriv endpoint. As a result, unauthenticated attackers can upload potentially executable files, leading to remote code execution. The nonce requirement can be easily bypassed, allowing exploitation with two unauthenticated HTTP requests.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which could be used to execute malicious code on the server.

Reproduction

To reproduce this vulnerability, send a request to the submit_form nopriv AJAX endpoint without proper authentication. Include a file in the request that exploits the arbitrary file upload vulnerability. The uploaded file can then be executed, leading to remote code execution.

Remediation

Users are advised to update the Super Forms – Drag & Drop Form Builder plugin to version 6.3.314 or later.