{"vulnerability": "cve-2026-14894", "sightings": [{"uuid": "16d50cd7-dcd9-4338-aa15-e0d57c2c70f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116893799245990836", "content": "CVE-2026-14894 (CRITICAL, CVSS 9.8): Arbitrary file upload in Super Forms \u2013 Drag & Drop Form Builder <=6.3.313 enables unauthenticated RCE. Restrict plugin use & monitor for uploads. Await vendor patch. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c0c00613 #OffSeq #WordPress #Infosec #Vulnerability", "creation_timestamp": "2026-07-10T04:30:26.120862Z"}, {"uuid": "e5b0ac4d-2f20-4c19-879f-6e5ee0b846fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-14894", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqbctmoxsp2t", "content": "Super Forms \u2013 Drag & Drop Form Builder <=6.3.313 hit by CRITICAL (CVSS 9.8) arbitrary file upload (CVE-2026-14894). RCE possible. Restrict plugin use & monitor for malicious uploads. Patch status unknown. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c...", "creation_timestamp": "2026-07-10T04:30:27.854856Z"}, {"uuid": "7395d359-5436-4463-8ab0-bf3411827ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbejahe4o2d", "content": "\ud83d\udd34 CVE-2026-14894 - Critical (9.8)\n\nThe Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-14894/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T05:00:33.799701Z"}, {"uuid": "e9abe905-e2ae-4cf1-ab61-30dca24492f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqbff75pa62b", "content": "CVE-2026-14894\nThe Super Forms plugin for WordPress is vulnerable to malicious file uploads, which could allow attackers to execute code on a website. This is a concern because it could lead to unauthorized access to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-10T05:16:05.207163Z"}, {"uuid": "304810a5-64f2-4b88-b7fe-2f257a0c1550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgp7km5h2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14894 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Super Forms \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/F93A86C3-7654-4B7A-994C-5E69571E271D", "creation_timestamp": "2026-07-10T05:39:34.500659Z"}, {"uuid": "23f737f6-df81-4c04-a8bc-fa7e04907cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqbhp5k26327", "content": "CVE-2026-14894 - Super Forms\nCVE ID : CVE-2026-14894\n \n Published : July 10, 2026, 4:17 a.m. | 14\u00a0minutes ago\n \n Description : The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.3...", "creation_timestamp": "2026-07-10T05:57:26.698446Z"}, {"uuid": "96668403-a20f-4abe-8b36-44253fee8d60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwjsui6h2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-14894 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Super Forms \u0434\u043b\u044f WordPress: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AD7D78E6-048A-4148-9833-8D5C42B6E8EE", "creation_timestamp": "2026-07-10T19:55:32.882160Z"}, {"uuid": "a9573d31-506b-4873-b3bd-670965982159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mqde7oxpes2r", "content": "CVE-2026-14894. Super Forms up to 6.3.313. CVSS 9.8. Any visitor uploads arbitrary files. No auth. No validation. Your wp-config. Your database dumps. Gone.\n\nUpdate to 6.3.313 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "creation_timestamp": "2026-07-11T00:00:29.027452Z"}, {"uuid": "d5887c5c-6075-4890-ba57-53a357f05928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14894", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mqf2l3jcd325", "content": "\ud83d\udd34 EXPLOITED\n\nA critical flaw in the Super Forms WordPress plugin lets a stranger upload a file and run code on your site, no login needed.\n\nA public exploit is already circulating.\n\nAffects every version up to 6.3.313. Fix: update to 6.3.314. (CVE-2026-14894)", "creation_timestamp": "2026-07-11T16:13:10.343724Z"}]}