Security1 publisher2 min readPublished
Attackers are planting PHP webshells through the WordPress Super Forms upload flaw
CVE-2026-14894 gives an unauthenticated attacker code execution on a WordPress site, and the fix is Super Forms 6.3.314. Microsoft separately reports invisible Unicode tag characters at up to 2.37 million messages a day.
The Watch · Security desk
What happened
- The upload is being used to place and execute PHP webshells, which can give an attacker complete control of the affected site.
- Microsoft tracked a phishing campaign from February through June that hid invisible Unicode tag characters inside financial lure terms such as "funding" to evade detection.
- That campaign reached as many as 2.37 million messages a day and, according to Microsoft, potentially disrupted ML- and NLP-based filtering.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure No credentials and no user interaction are required, so the qualifying condition for compromise is that the plugin is installed and the form endpoint answers a request.
- decision A version bump leaves an already-written webshell on disk, so operators have to decide whether every unpatched internet-facing install gets a file-level integrity review or just an update.
- constraint Model tuning cannot recover a string that has been doctored before scoring, which puts the remedy in the mail pipeline as a normalization step.
- precedent Tag characters now have production-scale volume behind them against classifiers, and the same characters work on an LLM reading the same message, so a pipeline that does not normalize inherits both problems.
Unauthenticated arbitrary file upload is the simplest exploitation path there is. Reach the endpoint, post a PHP file, request it back. SecurityWeek reports attackers are exploiting CVE-2026-14894 in the WordPress Super Forms plugin, and that the uploaded webshell can give complete control of the affected site [1][2]. The fix is version 6.3.314 [3].
Updating closes the upload, but it does not remove a file an attacker already wrote. Any install that sat unpatched on the internet needs its web root and the plugin's upload directories read by hand, looking for new or recently modified PHP in directories that should only hold form attachments [1][2].
The item gives the flaw class, the webshell outcome and the patch version, and it names no threat actor, no victim count and no date for when exploitation began [8]. Exploitation is confirmed. The size of the exposed population is not published.
The mail-side item has numbers. Microsoft says attackers inserted invisible Unicode tag characters into financial lure terms such as "funding" to evade phishing detection, in a campaign tracked from February through June [4][5]. Those characters are the same class used in prompt injection work, where the technique is called ASCII Smuggling [4]. A person reads "funding"; the filter tokenizes a string with extra code points spliced through it [4][5]. Volume reached as many as 2.37 million messages a day, which Microsoft says potentially disrupted ML- and NLP-based filtering [6]. That is roughly 27 messages a second [1], sustained across a five-month window [2]. Insertion at that rate comes from the sending infrastructure.
A retrained classifier does not fix this, because the classifier is being handed doctored input. The change sits earlier in the pipeline: normalize the message, strip or flag tag characters, then score. The same normalization gap applies to anything else reading the mailbox, which is the point the prompt injection researchers were making with these code points first [4].
The FBI, in the same week, warned about OAuth consent phishing. Attackers impersonate trusted figures and send targets to malicious applications that request legitimate-looking permissions, which grants persistent access to email, files and other data without stealing a password [7].
What to watch
- Any install count or scanner telemetry for vulnerable Super Forms deployments, which no current report provides.
- Whether Microsoft or mail vendors ship normalization that strips Unicode tag characters before classification, or detection signatures for the lure words.
- Whether the same tag-character insertion appears in mail read by LLM assistants, joining the phishing-filter evasion to the prompt injection use.