Multi-threaded mass exploiter chaining unauthenticated WordPress file-upload flaws in Super Forms and Elementor Pro to deploy and verify a PHP web shell.
Arbitrary File Upload
🩸 Join our Telegram for the latest exclusive 0-days & weaponized CVEs 📡 Channel: https://t.me/KNxploited 👤 Nxploited | @Kxploit
A high-speed, multi-threaded mass exploiter that chains two unauthenticated arbitrary file upload vulnerabilities in WordPress plugins — delivering a verified web shell on every successful hit.
| CVE-2026-14894 | CVE-2026-32475 | |
|---|---|---|
| Plugin | Super Forms – Drag & Drop Form Builder | Elementor Pro |
| Affected | Unpatched installations (≤ disclosed build) | ≤ 4.2.1 |
| Type | Unauthenticated Arbitrary File Upload | Unrestricted File Upload (Unauth) |
| Entry point | admin-ajax.php → super_submit_form | admin-ajax.php → elementor_pro_forms_send_form |
| Auth needed | ❌ None | ❌ None |
| Impact | Remote Code Execution (web shell) | Remote Code Execution (web shell) |
Both flaws were publicly disclosed in 2026 and are exploited in the wild — hundreds of thousands of exploit attempts have been recorded against exposed WordPress installations.
super_create_nonce AJAX action.super_submit_form carrying a base64 datauristring PHP shell disguised as an image attachment.../ × depth) to plant the shell directly in wp-content/uploads/superforms/, the uploads root, or the active theme directory.YYYY/MM upload paths.Nx.php?sig=1 must return the Nx-zD marker byte-for-byte.Root cause: file validation and file processing run in two separate loops — a UPLOAD_ERR_NO_FILE entry makes validation return early (skipping the extension check) while processing still move_uploaded_file()'s the second entry.
/contact/, /apply/, /upload/, …) to discover Elementor forms with optional file-upload fields (required fields and captcha-protected forms are skipped).0) + the PHP shell (index 1) — bypassing the extension check.<uniqid()>.php filename by parsing the JSON response, or sweeping uploads/elementor/forms/ hex-timestamp candidates around the server clock window.409 humans_21909 bot-wall cookies and retries.A minimal Nxploited-branded upload gateway (Nx.php) is deployed — a clean web UI for uploading any further files directly into the web root. No bloat, no dead code.
Nx_shells.txtpip install requests urllib3 rich
python CVE-2026-14894.py
You will be prompted for:
| Option | Default | Description |
|---|---|---|
| Targets file | list.txt | One URL per line (# comments allowed) |
| Threads | 10 | Concurrent workers |
| Strategy | both | predictable / normal / both |
| Min depth | 1 | Path-traversal depth lower bound (max 15) |
| Max depth | 10 | Path-traversal depth upper bound |
| Form IDs | 1,2,3,0 | Comma-separated Super Forms IDs to try |
| Debug | no | Writes verbose 49_debug.log |
NX_AUTO=1 NX_TARGETS=targets.txt NX_THREADS=50 NX_STRATEGY=both python CVE-2026-14894.py
| Env var | Description |
|---|---|
NX_AUTO | Set to 1 to skip all prompts |
NX_TARGETS | Targets file path |
NX_THREADS | Worker count |
NX_STRATEGY | predictable / normal / both |
NX_FORM_IDS | Comma-separated form IDs |
NX_DEBUG | 1 enables debug logging |
Nx_shells.txt ← every verified shell URL (one per line)
49_debug.log ← verbose trace (debug mode only)
Verify any hit manually:
http://target/.../Nx.php?sig=1 → must return: Nx-zD
This tool is provided for authorized security testing, research, and educational purposes only. The developer is not responsible for any misuse or damage. You are solely responsible for obtaining written permission before testing any target.
New exclusive 0-days and weaponized CVEs are dropped continuously:
By: Nxploited