{"vulnerability": "CVE-2026-14894", "sightings": [{"uuid": "16d50cd7-dcd9-4338-aa15-e0d57c2c70f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116893799245990836", "content": "CVE-2026-14894 (CRITICAL, CVSS 9.8): Arbitrary file upload in Super Forms \u2013 Drag & Drop Form Builder <=6.3.313 enables unauthenticated RCE. Restrict plugin use & monitor for uploads. Await vendor patch. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c0c00613 #OffSeq #WordPress #Infosec #Vulnerability", "creation_timestamp": "2026-07-10T04:30:26.120862Z"}, {"uuid": "e5b0ac4d-2f20-4c19-879f-6e5ee0b846fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqbctmoxsp2t", "content": "Super Forms \u2013 Drag & Drop Form Builder <=6.3.313 hit by CRITICAL (CVSS 9.8) arbitrary file upload (CVE-2026-14894). RCE possible. Restrict plugin use & monitor for malicious uploads. Patch status unknown. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c...", "creation_timestamp": "2026-07-10T04:30:27.854856Z"}, {"uuid": "7395d359-5436-4463-8ab0-bf3411827ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbejahe4o2d", "content": "\ud83d\udd34 CVE-2026-14894 - Critical (9.8)\n\nThe Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-14894/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T05:00:33.799701Z"}, {"uuid": "e9abe905-e2ae-4cf1-ab61-30dca24492f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqbff75pa62b", "content": "CVE-2026-14894\nThe Super Forms plugin for WordPress is vulnerable to malicious file uploads, which could allow attackers to execute code on a website. This is a concern because it could lead to unauthorized access to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T05:16:05.207163Z"}, {"uuid": "304810a5-64f2-4b88-b7fe-2f257a0c1550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgp7km5h2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14894 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Super Forms \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/F93A86C3-7654-4B7A-994C-5E69571E271D", "creation_timestamp": "2026-07-10T05:39:34.500659Z"}, {"uuid": "23f737f6-df81-4c04-a8bc-fa7e04907cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqbhp5k26327", "content": "CVE-2026-14894 - Super Forms\nCVE ID : CVE-2026-14894\n \n Published : July 10, 2026, 4:17 a.m. | 14\u00a0minutes ago\n \n Description : The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.3...", "creation_timestamp": "2026-07-10T05:57:26.698446Z"}, {"uuid": "96668403-a20f-4abe-8b36-44253fee8d60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwjsui6h2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14894 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Super Forms \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AD7D78E6-048A-4148-9833-8D5C42B6E8EE", "creation_timestamp": "2026-07-10T19:55:32.882160Z"}, {"uuid": "a9573d31-506b-4873-b3bd-670965982159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mqde7oxpes2r", "content": "CVE-2026-14894. Super Forms up to 6.3.313. CVSS 9.8. Any visitor uploads arbitrary files. No auth. No validation. Your wp-config. Your database dumps. Gone.\n\nUpdate to 6.3.313 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "creation_timestamp": "2026-07-11T00:00:29.027452Z"}, {"uuid": "d5887c5c-6075-4890-ba57-53a357f05928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mqf2l3jcd325", "content": "\ud83d\udd34 EXPLOITED\n\nA critical flaw in the Super Forms WordPress plugin lets a stranger upload a file and run code on your site, no login needed.\n\nA public exploit is already circulating.\n\nAffects every version up to 6.3.313. Fix: update to 6.3.314. (CVE-2026-14894)", "creation_timestamp": "2026-07-11T16:13:10.343724Z"}, {"uuid": "63c3ac5c-3ae4-4944-b077-068492cbd6cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93722", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #0day #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-14894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 15:43:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSuper Forms Unauthenticated File Upload RCE | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T18:00:03.845529Z"}, {"uuid": "85c25876-5dcd-4ecb-83ab-007a3498293c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/VUu0fqQ7rcdyvOW-H7Wu47NspWJgobhVReaY3yiN0ecBUoE", "content": "", "creation_timestamp": "2026-07-16T19:00:11.615083Z"}, {"uuid": "225b1e2e-23ed-4b8e-ab07-9a9d63406fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/VUu0fqQ7rcdyvOW-H7Wu47NspWJgobhVReaY3yiN0ecBUoE", "content": "", "creation_timestamp": "2026-07-17T00:00:27.159139Z"}, {"uuid": "d0fde7c5-9b5a-41d7-80f2-b0fdcf8f7bd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93722", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #0day #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-14894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 15:43:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSuper Forms Unauthenticated File Upload RCE | CVSS 9.8\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:49.236474Z"}, {"uuid": "867db9bf-ad90-4a02-a4a3-74f3f9620c43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "Telegram/VUu0fqQ7rcdyvOW-H7Wu47NspWJgobhVReaY3yiN0ecBUoE", "content": "", "creation_timestamp": "2026-07-18T00:00:44.985280Z"}, {"uuid": "1265ef63-390c-44de-87cd-1041dec0a426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-20T18:00:13.056565Z"}, {"uuid": "3dc101f9-5659-4352-a2de-ab0745638921", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/LwNfyNhQSYUmausIvNXRg51XKbFkPHSsVpOI-NhFx_OwOmc", "content": "", "creation_timestamp": "2026-07-20T18:00:13.264077Z"}, {"uuid": "52343556-5feb-4d3e-9afc-732980cf33b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/LwNfyNhQSYUmausIvNXRg51XKbFkPHSsVpOI-NhFx_OwOmc", "content": "", "creation_timestamp": "2026-07-21T00:00:36.143388Z"}, {"uuid": "7a74a9ec-7ddb-4227-a45e-db5fa6687904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-21T00:00:35.709170Z"}, {"uuid": "92da665b-9fa7-486c-be74-b798e5bf498e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "Telegram/LwNfyNhQSYUmausIvNXRg51XKbFkPHSsVpOI-NhFx_OwOmc", "content": "", "creation_timestamp": "2026-07-22T00:00:03.564020Z"}, {"uuid": "97ad25f5-95ae-49d5-a889-cc9276a5484a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "published-proof-of-concept", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-22T00:00:04.018395Z"}]}