Threat actors are actively exploiting two critical vulnerabilities in WordPress plugins Super Forms and Elementor Pro. CVE-2026-14894 (CVSS 9.8) affects Super Forms – Drag & Drop Form Builder, allowing unauthenticated attackers to upload arbitrary file types, potentially enabling remote code execution. Over 440,000 exploit attempts have been recorded targeting these flaws, according to Wordfence. The vulnerabilities pose a significant risk to WordPress websites using these popular plugins. Site administrators are urged to apply patches immediately to prevent unauthorized access and potential full site compromise.
Two critical arbitrary file upload vulnerabilities affect WordPress plugins Super Forms and Elementor Pro. CVE-2026-14894 (CVSS 9.8) is a missing file type validation flaw in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload executable PHP files via an HTTP POST request to '/wp-admin/admin-ajax.php' using the 'super_submit_form' action endpoint. The payload is Base64-encoded and disguised with a 'data:image/gif;base64' content type prefix. The uploaded file is a PHP web shell named 'Mushr00w_upl.php' which acts as a conduit for uploading additional payloads. Exploitation began July 14, 2026, peaking at over 40,000 requests on August 18, 2026, with over 250,000 attempts blocked. CVE-2026-32475 (CVSS 9.0/9.8) affects Elementor Pro and is triggered by submitting the File Upload form field as an array where the first element is empty and the second carries a PHP payload with a .php extension, bypassing validation. The uploaded PHP file is placed in '/wp-content/uploads/elementor/forms/' under a randomly generated filename, allowing direct execution of arbitrary commands. Exploitation began August 19, 2026, with over 190,000 attempts blocked. Both vulnerabilities enable RCE, creation of admin accounts, data exfiltration, and full site takeover.
1. Immediately apply patches: update Super Forms – Drag & Drop Form Builder to version 6.3.314 or later, and Elementor Pro to version 4.2.2 or later. 2. Scan WordPress sites for indicators of compromise, including unexpected or recently modified .php files. 3. Audit the '/wp-content/uploads/elementor/forms/' directory and WordPress uploads directory for unauthorized PHP files. 4. Review server logs for POST requests to '/wp-admin/admin-ajax.php' with the 'super_submit_form' action. 5. Block or monitor the listed malicious IP addresses at the firewall or WAF level. 6. Audit administrator accounts for unauthorized additions. 7. Check for signs of data exfiltration or unauthorized access.
103.168.147.235, 103.168.146.131, 103.154.152.178, 103.170.97.7, 182.10.130.51, 189.4.122.140, 129.227.46.143, 64.176.209.104, 103.164.182.122, 37.9.33.62, 2602:fa59:10:7a1::1, 185.196.220.85, 103.84.230.85, 103.90.148.202, 216.126.225.208, 167.254.240.75, 167.254.241.119, 114.10.17.253, 114.10.45.151, 2406:ef80:2:7d19::1, Mushr00w_upl.php, /wp-content/uploads/elementor/forms/, action=super_submit_form, /wp-admin/admin-ajax.php
