Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
4
Contributors
9
Categories
9
8
3
2
1
Platforms
7
4
Products / Services
5
5
5
5
4
MITRE Techniques
9
2
2
1
1
CVEs
71
71
64
58
49
IDS Classtypes
3
1
IDS Protocols
3
1
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects inbound network traffic originating from IP addresses known to be associated with an exploit campaign targeting the Super Forms plugin (CVE-2026-14894). The rule acts as an indicator of compromise (IoC) match for potential exploitation attempts directed at internal network infrastructure.
Detects an attempt to exploit CVE-2026-14894 within the Super Forms plugin by sending a crafted HTTP POST request to admin-ajax.php. The attack attempts to upload an obfuscated PHP web shell disguised as a base64-encoded GIF image.
This rule detects attempts to exploit a vulnerability in the WordPress Super Forms plugin (CVE-2026-14894). The rule monitors for malicious file upload requests containing embedded PHP code or attempts to bypass filename extensions for PHP files via the super_submit_form AJAX action.
Detects mass automated POST requests directed at the 'super_submit_form' action within the 'admin-ajax.php' endpoint of the Super Forms WordPress plugin, indicative of exploitation attempts or vulnerability scanning against CVE-2026-14894.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.