More than 440,000 exploit attempts — roughly 250,000 aimed at Super Forms and 190,000 at Elementor Pro — have been blocked by Wordfence, the company reported.
The two critical flaws at the center: CVE-2026-14894 and CVE-2026-32475
Wordfence and other security researchers identified two high-severity vulnerabilities in widely used WordPress plugins. CVE-2026-14894 (CVSS 9.8) is a missing file-type validation flaw in Super Forms – Drag & Drop Form Builder that permits unauthenticated attackers to upload files of any type, including executable PHP files; the issue was fixed in Super Forms version 6.3.314. CVE-2026-32475 (CVSS 9.0/9.8) affects Elementor Pro and likewise permits unauthenticated arbitrary file uploads, enabling remote code execution; the vulnerability was fixed in Elementor Pro version 4.2.2. Patchstack disclosed details about CVE-2026-32475 last month.
How attackers weaponize Super Forms (the upload pattern)
Wordfence describes active exploitation against CVE-2026-14894 that issues an HTTP POST to /wp-admin/admin-ajax.php using the super_submit_form endpoint. The payload includes a file field holding a Base64-encoded PHP payload disguised with a data:image/gif;base64 content type and an attacker-controlled filename. The uploaded file — despite the image content type — is a PHP web‑shell named in observed attacks as "Mushr00w_upl.php". That web shell then serves as a conduit to drop additional payloads onto the site.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow Elementor Pro uploads bypass validation
Wordfence explains the Elementor Pro exploit as a structural manipulation of the Form widget's File Upload field. "The attacker submits the form's File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php file name, which is the structure that triggers the validation bypass," the company said. Once written, the uploaded PHP file is placed in /wp-content/uploads/elementor/forms/ under a randomly generated filename that keeps the attacker-supplied .php extension, and "the attacker can request it directly to execute arbitrary commands on the server."
Timeline, scale and origin points of observed activity
Wordfence reports the first malicious activity exploiting the Super Forms flaw began on July 14, 2026, and grew to a peak exceeding 40,000 exploit requests on August 18, 2026. The attacks exploiting CVE-2026-14894 were observed originating from the following IP addresses: 103.168.147.235; 103.168.146.131; 103.154.152.178; 103.170.97.7; 182.10.130.51; 189.4.122.140; 129.227.46.143; 64.176.209.104; 103.164.182.122; and 37.9.33.62.
Exploitation efforts targeting CVE-2026-32475 began on August 19, 2026. Observed origin addresses for those attempts include 2602:fa59:10:7a1::1; 185.196.220.85; 103.84.230.85; 103.90.148.202; 216.126.225.208; 167.254.240.75; 167.254.241.119; 114.10.17.253; 114.10.45.151; and 2406:ef80:2:7d19::1.
What Wordfence and the record show attackers can achieve
Both vulnerabilities permit an attacker to write a PHP web shell to the site and execute arbitrary code. Wordfence notes those capabilities can be abused to create administrator accounts, exfiltrate data, or seize control of the entire WordPress site. For Elementor Pro specifically, successful exploitation requires that the target site have at least one published Elementor page containing a Form widget with a File Upload field.
How WordPress site owners, plugin maintainers, and security teams should respond
- WordPress site owners: apply the available patches immediately — Super Forms to version 6.3.314 and Elementor Pro to version 4.2.2 — then scan sites for indicators of compromise and audit for unexpected or recently modified .php files.
- Plugin maintainers: ensure users are informed of the fixed versions and continue monitoring for any secondary exploitation vectors tied to file-upload handling.
- Security teams and responders: hunt for the specific web‑shell artifacts described (for example, uploader files placed in uploads paths such as /elementor/forms/), inspect recent uploads and administrator account changes, and review logs for the POST patterns Wordfence documented.
The scope and tempo of activity recorded by Wordfence — hundreds of thousands of blocked attempts across two high-severity flaws — underline a clear operational window: patched plugin releases exist, but unpatched installations offer a straightforward path for attackers to place PHP web shells, then escalate to site takeover or data theft. Immediate patching, focused file-audit searches, and log reviews are the concrete steps the reporting itself recommends.
