shinthink/CVE-2026-14894

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-14894 that achieves unauthenticated remote code execution on WordPress sites running Super Forms <= 6.3.313 by obtaining a nonce via super_create_nonce, uploading a PHP webshell via super_submit_form, and executing commands.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python exploit script for CVE-2026-14894 and a README. The script performs the disclosed unauthenticated file upload and remote code execution against a target WordPress site. It generates a PHP webshell with a random token for access control, executes a test command, and cleans up the shell by default. No concealed, unrelated, or misrepresented harmful behavior was found. The code's actions are consistent with the documented exploit.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareWordPressSuper Forms – Drag & Drop Form Builder
Attack typesarbitrary file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits the vulnerability by obtaining a nonce, uploading a PHP webshell, and executing commands on the target, which constitutes an exploit.

cve_2026_14894.py:1-338

Requirements

  • Target must run WordPress with Super Forms plugin version <= 6.3.313.cve_2026_14894.py:6
  • Target must expose wp-admin/admin-ajax.php and allow unauthenticated POST requests.cve_2026_14894.py:130-131

Observed behavior

  • Sends unauthenticated POST to super_create_nonce AJAX endpoint to obtain a valid nonce.cve_2026_14894.py:137-149
  • Uploads a Base64-encoded PHP webshell via the super_submit_form AJAX handler using the obtained nonce.cve_2026_14894.py:151-209
  • Executes system commands on the target by requesting the uploaded webshell with a command parameter.cve_2026_14894.py:232-235
  • Optionally cleans up by deleting the uploaded webshell after exploitation.cve_2026_14894.py:237-239
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://target.com/wp-content/uploads/superforms/think_abc.php?t=TOKENExample shell URL from README output, consistent with the exploit's target-side payload.README.md:150
Url
https://target.com/wp-admin/admin-ajax.phpTarget WordPress AJAX endpoint used for nonce generation and file upload.README.md:173-174cve_2026_14894.py:59
Command
id;hostname;uname -aTest command executed on the target to confirm RCE.cve_2026_14894.py:233
File Write
/wp-content/uploads/superforms/Target directory where the PHP webshell is uploaded.README.md:79cve_2026_14894.py:185
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the packet; it is unlikely to affect classification.
  • The evidence is not executed; classification is based solely on static analysis of the provided source code.
  • One file (metadata only) was omitted from the evidence packet, but it is not a text file and its absence does not affect the review of the core exploit logic.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1