A fresh surge in cyberattacks has been detected targeting Remote Code Execution (RCE) vulnerabilities in two widely used WordPress plugins—Super Forms and Elementor Pro. Over 440,000 exploit attempts have been blocked by security researchers as attackers attempt to upload executable PHP files and seize control of WordPress sites.
Critical Plugin Vulnerabilities
The two major plugins affected are:
- Super Forms (Drag & Drop Form Builder): With vulnerability tracked as CVE-2026-14894, this flaw has a severity score of 9.8. It allows unauthenticated users to upload files of any type—including PHP—because a file type validation is missing. The issue was addressed in Super Forms version 6.3.314.
- Elementor Pro: Identified as CVE-2026-32475, this vulnerability carries a severity score of 9.0/9.8 and similarly allows arbitrary file uploads. Patchstack initially disclosed this flaw. Successful exploitation requires an active Elementor page featuring a Form widget that includes a File Upload field. Fixed in Elementor Pro version 4.2.2.
Attack Campaign Details
Researchers at Wordfence revealed that as of now, more than 250,000 attempts have targeted CVE-2026-14894 in Super Forms, while around 190,000 have aimed at CVE-2026-32475 in Elementor Pro.
Super Forms Exploitation
The Super Forms attacks launch HTTP POST requests to “/wp-admin/admin-ajax.php” via the “super_submit_form” endpoint. Attackers embed a Base64-encoded PHP payload under the guise of a file upload that uses an image content type.
When executed, this uploads a PHP “web shell” script (named something like “Mushr00w_upl.php”) which becomes a platform for further malicious uploads. The activity began on July 14, 2026 and hit a peak with over 40,000 requests in a single day on August 18. Notable IPs involved include 103.168.147.235, 182.10.130.51, and several others.
Elementor Pro Exploitation
Attacks against Elementor Pro emerged from August 19, 2026. In these, the File Upload field on a form is manipulated so that while one element in the submitted array is empty, another carries a .php payload. The uploaded file lands in “/wp-content/uploads/elementor/forms/” with the attacker’s file name and extension and runs with whatever permissions the web server allows. IPs linked to these attempts include addresses such as 2602:fa59:10:7a1::1, 103.84.230.85, and 167.254.240.75 among others.
Recommended Mitigations
Website administrators using either plugin should immediately update to Super Forms version 6.3.314 or newer, and Elementor Pro version 4.2.2 or newer. It’s also advised to scan for unusual or recently modified .php files, check for unauthorized administrator accounts, and review upload directories for any web shells or suspicious content.
Analytical Take: The scale and speed of these exploit attempts underscore how vulnerable plugin ecosystems remain, especially when unauthenticated file uploads are involved. The ease of launching RCE attacks via arbitrary file uploads continues to be an attractive vector for attackers. Moving forward, plugin developers will need to prioritize strict validation and sanitization—even in widely trusted packages—and site owners must stay vigilant with patches and security hygiene.
