{"vulnerability": "CVE-2026-14894", "sightings": [{"uuid": "16d50cd7-dcd9-4338-aa15-e0d57c2c70f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116893799245990836", "content": "CVE-2026-14894 (CRITICAL, CVSS 9.8): Arbitrary file upload in Super Forms \u2013 Drag & Drop Form Builder <=6.3.313 enables unauthenticated RCE. Restrict plugin use & monitor for uploads. Await vendor patch. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c0c00613 #OffSeq #WordPress #Infosec #Vulnerability", "creation_timestamp": "2026-07-10T04:30:26.120862Z"}, {"uuid": "e5b0ac4d-2f20-4c19-879f-6e5ee0b846fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqbctmoxsp2t", "content": "Super Forms \u2013 Drag & Drop Form Builder <=6.3.313 hit by CRITICAL (CVSS 9.8) arbitrary file upload (CVE-2026-14894). RCE possible. Restrict plugin use & monitor for malicious uploads. Patch status unknown. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c...", "creation_timestamp": "2026-07-10T04:30:27.854856Z"}, {"uuid": "7395d359-5436-4463-8ab0-bf3411827ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbejahe4o2d", "content": "\ud83d\udd34 CVE-2026-14894 - Critical (9.8)\n\nThe Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-14894/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T05:00:33.799701Z"}, {"uuid": "e9abe905-e2ae-4cf1-ab61-30dca24492f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqbff75pa62b", "content": "CVE-2026-14894\nThe Super Forms plugin for WordPress is vulnerable to malicious file uploads, which could allow attackers to execute code on a website. This is a concern because it could lead to unauthorized access to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T05:16:05.207163Z"}, {"uuid": "304810a5-64f2-4b88-b7fe-2f257a0c1550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgp7km5h2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14894 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Super Forms \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/F93A86C3-7654-4B7A-994C-5E69571E271D", "creation_timestamp": "2026-07-10T05:39:34.500659Z"}, {"uuid": "23f737f6-df81-4c04-a8bc-fa7e04907cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqbhp5k26327", "content": "CVE-2026-14894 - Super Forms\nCVE ID : CVE-2026-14894\n \n Published : July 10, 2026, 4:17 a.m. | 14\u00a0minutes ago\n \n Description : The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.3...", "creation_timestamp": "2026-07-10T05:57:26.698446Z"}, {"uuid": "96668403-a20f-4abe-8b36-44253fee8d60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwjsui6h2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14894 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Super Forms \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AD7D78E6-048A-4148-9833-8D5C42B6E8EE", "creation_timestamp": "2026-07-10T19:55:32.882160Z"}, {"uuid": "a9573d31-506b-4873-b3bd-670965982159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mqde7oxpes2r", "content": "CVE-2026-14894. Super Forms up to 6.3.313. CVSS 9.8. Any visitor uploads arbitrary files. No auth. No validation. Your wp-config. Your database dumps. Gone.\n\nUpdate to 6.3.313 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "creation_timestamp": "2026-07-11T00:00:29.027452Z"}, {"uuid": "d5887c5c-6075-4890-ba57-53a357f05928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mqf2l3jcd325", "content": "\ud83d\udd34 EXPLOITED\n\nA critical flaw in the Super Forms WordPress plugin lets a stranger upload a file and run code on your site, no login needed.\n\nA public exploit is already circulating.\n\nAffects every version up to 6.3.313. Fix: update to 6.3.314. (CVE-2026-14894)", "creation_timestamp": "2026-07-11T16:13:10.343724Z"}, {"uuid": "63c3ac5c-3ae4-4944-b077-068492cbd6cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93722", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #0day #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-14894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 15:43:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSuper Forms Unauthenticated File Upload RCE | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T18:00:03.845529Z"}, {"uuid": "85c25876-5dcd-4ecb-83ab-007a3498293c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/VUu0fqQ7rcdyvOW-H7Wu47NspWJgobhVReaY3yiN0ecBUoE", "content": "", "creation_timestamp": "2026-07-16T19:00:11.615083Z"}, {"uuid": "225b1e2e-23ed-4b8e-ab07-9a9d63406fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/VUu0fqQ7rcdyvOW-H7Wu47NspWJgobhVReaY3yiN0ecBUoE", "content": "", "creation_timestamp": "2026-07-17T00:00:27.159139Z"}, {"uuid": "d0fde7c5-9b5a-41d7-80f2-b0fdcf8f7bd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93722", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #0day #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-14894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 15:43:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSuper Forms Unauthenticated File Upload RCE | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:49.236474Z"}, {"uuid": "867db9bf-ad90-4a02-a4a3-74f3f9620c43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "Telegram/VUu0fqQ7rcdyvOW-H7Wu47NspWJgobhVReaY3yiN0ecBUoE", "content": "", "creation_timestamp": "2026-07-18T00:00:44.985280Z"}, {"uuid": "1265ef63-390c-44de-87cd-1041dec0a426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-20T18:00:13.056565Z"}, {"uuid": "3dc101f9-5659-4352-a2de-ab0745638921", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/LwNfyNhQSYUmausIvNXRg51XKbFkPHSsVpOI-NhFx_OwOmc", "content": "", "creation_timestamp": "2026-07-20T18:00:13.264077Z"}, {"uuid": "52343556-5feb-4d3e-9afc-732980cf33b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/LwNfyNhQSYUmausIvNXRg51XKbFkPHSsVpOI-NhFx_OwOmc", "content": "", "creation_timestamp": "2026-07-21T00:00:36.143388Z"}, {"uuid": "7a74a9ec-7ddb-4227-a45e-db5fa6687904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-21T00:00:35.709170Z"}, {"uuid": "92da665b-9fa7-486c-be74-b798e5bf498e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "Telegram/LwNfyNhQSYUmausIvNXRg51XKbFkPHSsVpOI-NhFx_OwOmc", "content": "", "creation_timestamp": "2026-07-22T00:00:03.564020Z"}, {"uuid": "97ad25f5-95ae-49d5-a889-cc9276a5484a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-22T00:00:04.018395Z"}, {"uuid": "3860c631-ce04-4450-9e76-483b0f5d93c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3munuoyee752i", "content": "CVE-2026-14894, a critical Super Forms vulnerability, is exploited in the wild. The 9.8 CVSS file upload flaw enables unauthenticated remote code execution.\n\n#SuperForms #WordPress #CVE202614894 #RCE #FileUpload #WebSecurity #InfoSec #ExploitedInTheWild", "creation_timestamp": "2026-09-04T02:02:43.409379Z"}, {"uuid": "7b847a71-6f00-4499-9808-14c275eeef1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html", "content": "Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence.\n\nThe vulnerabilities in question are -\n\n\n  CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms \u2013 Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including", "creation_timestamp": "2026-09-04T10:00:43.855941Z"}, {"uuid": "e36054d7-7594-4827-b172-7a6cb81a34a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3muos437cop2t", "content": "Critical WordPress RCE Flaws in Super Forms and Elementor Pro Trigger Over 440,000 Exploit\u00a0Attempts\n\nCritical WordPress flaws in Super Forms and Elementor Pro are under active attack. Learn\u2026\n\nhttps://thecybersecguru.com/news/wordpress-super-forms-elementor-pro-rce-cve-2026-14894-cve-2026-32475/", "creation_timestamp": "2026-09-04T10:49:00.798863Z"}, {"uuid": "519d6ef4-f388-4a3f-9335-1adaec26d04e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3muot7hexrs2z", "content": "Update WordPress Super Forms to 6.3.314 now \u2014 CVE-2026-14894 (CVSS 9.8), an unauthenticated file-upload RCE, is under mass exploitation per Wordfence. Elementor Pro is also hit. https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html", "creation_timestamp": "2026-09-04T11:08:48.249343Z"}, {"uuid": "f014ce41-9d59-4893-b9c9-e9ef445eb8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "exploited", "source": "Telegram/WuJqIzV8BnV7fs5RI4sj1mbBud6jNsAz2b4RIldDc5qdyQ", "content": "", "creation_timestamp": "2026-09-04T15:00:06.086513Z"}, {"uuid": "03813493-bdc4-4c8a-a305-405074f5af8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "exploited", "source": "Telegram/WuJqIzV8BnV7fs5RI4sj1mbBud6jNsAz2b4RIldDc5qdyQ", "content": "", "creation_timestamp": "2026-09-05T01:00:26.064307Z"}, {"uuid": "3f1f1b20-d225-4083-8f6e-56375ecb2887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html", "content": "Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence.\n\nThe vulnerabilities in question are -\n\n\n  CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms \u2013 Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including", "creation_timestamp": "2026-09-05T01:00:33.956605Z"}, {"uuid": "4b881c89-affc-49ae-a1db-36e2078008a5", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2c41abe6-6af3-4176-9784-e7ef20f86a57", "content": "", "creation_timestamp": "2026-09-05T12:00:36.689453Z"}, {"uuid": "68df96ba-b75c-49a5-af00-d1c42a948a5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3murkjm6wys25", "content": "Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws\n\nThreat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence.\n\nThe vulnerabilities in question are -\n\nCVE-2026-14894 (\u2026\n#hackernews #news", "creation_timestamp": "2026-09-05T13:11:24.461173Z"}]}