Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Two critical unauthenticated RCE vulnerabilities (CVE-2026-14894, CVSS 9.8; CVE-2026-32475, CVSS 9.0/9.8) in WordPress plugins Super Forms and Elementor Pro are being actively exploited at scale Over 440,000 exploit attempts have been blocked by Wordfence — 250,000+ targeting Super Forms and 190,000+ targeting Elementor Pro Both vulnerabilities stem from missing file type validation, allowing attackers to upload PHP web shells and achieve remote code execution on affected sites The Super Forms e
Analysis
TL;DR
- Two critical unauthenticated RCE vulnerabilities (CVE-2026-14894, CVSS 9.8; CVE-2026-32475, CVSS 9.0/9.8) in WordPress plugins Super Forms and Elementor Pro are being actively exploited at scale
- Over 440,000 exploit attempts have been blocked by Wordfence — 250,000+ targeting Super Forms and 190,000+ targeting Elementor Pro
- Both vulnerabilities stem from missing file type validation, allowing attackers to upload PHP web shells and achieve remote code execution on affected sites
- The Super Forms exploit uses a Base64-encoded PHP payload disguised as a GIF via the admin-ajax.php endpoint, while Elementor Pro exploitation bypasses validation by submitting the file upload field as an array with an empty first element
- Patches are available (Super Forms v6.3.314, Elementor Pro v4.2.2), and site owners are urged to update immediately, scan for indicators of compromise, and audit for suspicious .php files
Why It Matters
This incident highlights the ongoing threat of arbitrary file upload vulnerabilities in widely used WordPress plugins, which remain a top attack vector for website compromise. With over 440,000 exploit attempts already recorded, WordPress site owners and developers must treat plugin supply-chain security as a critical priority, especially given how quickly unpatched vulnerabilities are weaponized in the wild.
Technical Details
- CVE-2026-14894 (Super Forms – Drag & Drop Form Builder, CVSS 9.8): Unauthenticated attackers can upload arbitrary files, including PHP executables, due to missing file type validation. Exploitation sends an HTTP POST to
/wp-admin/admin-ajax.phpvia thesuper_submit_formendpoint, embedding a Base64-encoded PHP web shell (e.g., "Mushr00w_upl.php") with a forgeddata:image/gif;base64content type. The web shell is stored on the server and used as a secondary upload conduit for further payloads. Attack activity began July 14, 2026, peaking at over 40,000 requests on August 18, 2026. - CVE-2026-32475 (Elementor Pro, CVSS 9.0/9.8): Unauthenticated PHP file upload via a validation bypass in the Form widget's File Upload field. Attackers submit the field as an array where the first element is empty and the second contains a PHP payload with a
.phpextension, tricking the validator into allowing the upload. The resulting web shell is placed in/wp-content/uploads/elementor/forms/under a randomly generated filename. Exploitation began August 19, 2026. - Fixed versions: Super Forms 6.3.314 and Elementor Pro 4.2.2.
- Attack infrastructure: Exploits originate from a distributed set of IPv4 and IPv6 addresses across multiple geographies, indicating coordinated automated scanning and exploitation campaigns.
- Impact chain: Successful exploitation leads to full site compromise — attackers can create admin accounts, exfiltrate data, deploy additional malware, or use the server as a pivot point.
Industry Insight
- WordPress plugin security remains a systemic weak point: arbitrary file upload flaws in popular plugins continue to be weaponized within days of disclosure, underscoring the need for stricter security review processes and mandatory file validation in form-handling code.
- Organizations running WordPress should implement a rapid patching cadence, deploy web application firewalls (WAFs) with file-upload inspection rules, and conduct regular audits of uploaded files in
/wp-content/uploads/directories to detect compromise early. - The coordinated, multi-IP attack pattern suggests botnet-driven exploitation at scale; this reinforces the importance of rate-limiting form submission endpoints and monitoring for anomalous upload activity as a defensive layer beyond patching alone.
Disclaimer: The above content is generated by AI and is for reference only.