CVE

CVE-2026-14894

View on NVD ↗

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

Exploitation IoCs 21

Filename Mushr00w_upl.php
IP 103[.]154[.]152[.]178
IP 103[.]164[.]182[.]122
IP 103[.]168[.]146[.]131
IP 103[.]168[.]147[.]235
IP 103[.]170[.]97[.]7
IP 103[.]84[.]230[.]85
IP 103[.]90[.]148[.]202
IP 114[.]10[.]17[.]253
IP 114[.]10[.]45[.]151
IP 129[.]227[.]46[.]143
IP 167[.]254[.]240[.]75
IP 167[.]254[.]241[.]119
IP 182[.]10[.]130[.]51
IP 185[.]196[.]220[.]85
IP 189[.]4[.]122[.]140
IP 216[.]126[.]225[.]208
IP 2406:ef80:2:7d19::1
IP 2602:fa59:10:7a1::1
IP 37[.]9[.]33[.]62
IP 64[.]176[.]209[.]104

MITRE ATT&CK TTPs 2

T1059.001
PowerShell
Execution
 T1190
Exploit Public-Facing Application
Initial Access

Source Articles

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Threat actors are actively exploiting two critical remote code execution (RCE) vulnerabilities in WordPress plugins Super Forms and Elementor Pro. CVE-2026-14894 and CVE-2026-32475 allow unauthenticated attackers to upload arbitrary PHP files, enabling remote code execution via web shells. Exploitation attempts have exceeded 440,000, with attacks observed since July 14, 2026, peaking in August. Attackers upload PHP web shells such as 'Mushr00w_upl.php' and leverage them to execute commands, exfiltrate data, or take control of WordPress sites.
hacker-news Sep 4, 2026