Loading vulnerability…
CVE-2026-14894 is an unrestricted file upload vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin through version 6.3.313. The submit_form functionality processes attacker-controlled encoded file data and writes it to disk without adequate file-type validation. Its unauthenticated AJAX handler lacks a capability check; the session nonce used as its sole access control can be obtained by unauthenticated visitors through a separate public nonce-generation action. An attacker can therefore submit an executable server-side file and potentially execute it through the web server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a standalone Python exploit for CVE-2026-14894 affecting the WordPress Super Forms plugin (WebRehab) versions <= 6.3.313. The repository is small and focused: a single exploit script (cve_2026_14894.py), a README with exploitation details and examples, and a minimal requirements.txt listing requests. The exploit is not merely a detector. It performs active exploitation by chaining two unauthenticated WordPress AJAX actions: first obtaining a nonce from /wp-admin/admin-ajax.php using action=super_create_nonce, then abusing action=super_submit_form to upload a Base64-encoded PHP payload disguised as a data URI. The uploaded file is written into /wp-content/uploads/superforms/ with an attacker-controlled filename, enabling direct web access and code execution. The Python script includes logic for target handling, HTTP session creation with randomized User-Agent strings, plugin detection/version checking via /wp-content/plugins/super-forms/readme.txt, exploitation workflow orchestration, and multithreaded mass targeting. The embedded payload generated by fm_code(token) is a PHP webshell with several capabilities: token-gated access, arbitrary command execution through the c parameter, file upload support, directory listing, and file deletion via del. This makes the exploit operational rather than a simple proof of concept. The script supports both single-target and bulk exploitation modes, optional output saving, debug/verbose logging, configurable threading, and optional cleanup behavior. Overall, the repository’s purpose is to automate unauthenticated RCE against vulnerable Super Forms installations by detecting the plugin, obtaining a nonce, uploading a PHP shell, verifying execution, and optionally retaining shell access for follow-on actions.
Repository contains a Python exploit and a PHP payload targeting CVE-2026-14894 in the WordPress Super Forms plugin (versions 6.3.313 and earlier). The main file, cve-2026-14894.py, is an interactive exploit tool for single-target and mass-target operation. It uses requests/urllib3, multithreading, randomized shell names, result serialization, and local JSON logging. The exploit chain is: obtain an unauthenticated nonce/session via the WordPress AJAX endpoint, submit a crafted file upload through the vulnerable super_submit_form action using a data URI, attempt path traversal into a theme directory for guaranteed execution, and then discover and invoke the uploaded shell to confirm RCE. The built-in payload is a simple PHP webshell that executes commands from the c parameter and prints markers plus php_uname()/getcwd() output. The script also supports custom shell files and fallback executable extensions such as .phtml and .phar when .php is blocked. The included beelze.php file is an obfuscated PHP payload beginning with a GIF header and using eval/gzinflate/base64_decode, consistent with a disguised webshell or secondary payload. Overall, this is a real operational exploit for unauthenticated arbitrary file upload leading to remote code execution, not merely a detector or README.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated arbitrary-file-upload vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin. Missing backend file-type and extension validation enables PHP web-shell upload and remote code execution.
An unauthenticated arbitrary-file-upload and remote-code-execution vulnerability in the WordPress Super Forms – Drag & Drop Form Builder plugin. Attackers submit a Base64-encoded PHP payload through the super_submit_form endpoint and can deploy PHP web shells.
Critical unauthenticated arbitrary-file-upload and remote-code-execution vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin. Attackers can upload PHP web shells, execute commands, create administrator accounts, exfiltrate data, and take over the affected WordPress site.
Critical (CVSS 9.8) unauthenticated arbitrary-file-upload vulnerability in the Super Forms WordPress plugin. Missing file-type validation, attacker-controlled filenames, and an ineffective nonce control permit attackers to write executable PHP files, potentially including via path traversal, leading to remote code execution and complete site compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.