Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Threat actors are actively exploiting two critical vulnerabilities in WordPress plugins, Super Forms and Elementor Pro, leading to a surge in exploit attempts. Over 250,000 attempts targeted CVE-2026-14894 (a file upload vulnerability) and 190,000 targeted CVE-2026-32475 (a file upload bypass). Attackers are leveraging these flaws to upload PHP web shells, allowing them to execute arbitrary code and potentially take full control of WordPress sites. The activity began in July 2026 and peaked in August 2026, with a significant number of attacks originating from various IP addresses. Immediate patching and monitoring are strongly advised.
Threat actors are exploiting two critical security flaws in WordPress plugins, Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are -
- CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including executable PHP files, leading to remote code execution. (Fixed in version 6.3.314)
- CVE-2026-32475 (CVSS score: 9.0/9.8) - A vulnerability in Elementor Pro that allows unauthenticated attackers to upload files of any type, including executable PHP files, leading to remote code execution. (Fixed in version 4.2.2)
As with arbitrary file upload vulnerabilities of this kind, an attacker can leverage them to write a PHP web shell to the site and execute arbitrary code, which can then be abused to create administrator accounts, exfiltrate data, or seize control of the entire WordPress site.
“The attacker submits the form’s File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php file name, which is the structure that triggers the validation bypass,” the WordPress security company said.
“Once written, the uploaded PHP file is placed in the '/wp-content/uploads/elementor/forms/' directory under a randomly generated filename with the attacker-supplied .php extension, and the attacker can request it directly to execute arbitrary commands on the server.”
Exploitation efforts targeting CVE-2026-32475 commenced on August 19, 2026, and have originated from the below IP addresses -
- 2602:fa59:10:7a1::1
- 185.196.220.85
- 103.84.230.85
- 103.90.148.202
- 216.126.225.208
- 167.254.240.75
- 167.254.241.119
- 114.10.17.253
- 114.10.45.151
- 2406:ef80:2:7d19::1
WordPress site owners using the two plugins are recommended to apply patches for the vulnerabilities with immediate effect, scan their sites for indicators of compromise, and audit for unexpected or recently modified .php files. The malicious activity is said to have begun on July 14, 2026, before scaling a peak of more than 40,000 exploit requests on August 18, 2026. Exploitation Against CVE-2026-14894: The attacks exploiting CVE-2026-14894, have originated from the following IP addresses -
- 103.168.147.235
- 103.168.146.131
- 103.154.152.178
- 103.170.97.7
- 182.10.130.51
- 189.4.122.140
- 129.227.46.143
- 64.176.209.104
- 103.164.182.122
- 37.9.33.62