WordPress Under Attack: More Than 440,000 Attempts Target Super Forms and Elementor Pro

Two critical vulnerabilities in the WordPress plugins Super Forms – Drag & Drop Form Builder and Elementor Pro are being actively exploited to upload PHP files and execute code on servers.

Wordfence has blocked more than 440,000 exploit attempts in total: over 250,000 targeting CVE-2026-14894 in Super Forms and more than 190,000 targeting CVE-2026-32475 in Elementor Pro.

In both cases, the attacks can be carried out without authentication. If exploitation succeeds, an attacker can install a web shell, execute commands, create WordPress administrators, steal data, and take control of the installation.

Two Campaigns Already Operating at Scale

Activity targeting Super Forms reportedly began on July 14, 2026, before exceeding 40,000 exploit requests on August 18, 2026. Attempts targeting the Elementor Pro vulnerability began on August 19, 2026.

Wordfence described the two campaigns in reports published during the same week. No specific criminal group has been attributed responsibility: the observed IP addresses identify infrastructure used in the attacks but do not prove the operators’ identity.

Both vulnerabilities fall under CWE-434, which covers unrestricted uploads of potentially dangerous files. The end result is similar, but the exploitation mechanisms differ.

For CVE-2026-14894, NVD assigns a CVSS 9.8 score with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

For CVE-2026-32475, the NVD score is CVSS 9:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Another assessment rates Elementor Pro’s severity at 9.0/9.8. This should be distinguished from the available official NVD score, which remains 9.

Super Forms Accepts PHP Disguised as an Image

CVE-2026-14894 affects all versions of Super Forms – Drag & Drop Form Builder up to and including 6.3.313. The issue was fixed in version 6.3.314.

The flaw is located in the AJAX workflow used to submit forms. The submit_form handler, which is also accessible to unauthenticated users through a nopriv endpoint, does not properly enforce file-type validation or check WordPress capabilities.

A session nonce was present, but it does not provide effective protection. An unauthenticated visitor can freely obtain it by calling another nopriv endpoint and then use it in the malicious request.

The observed attacks send POST requests to:

/wp-admin/admin-ajax.php

The request uses the super_submit_form action and includes parameters such as form_id=2, sf_nonce, sf_upload_field, and the files type. The attacker also controls the filename and the content being uploaded.

In one analyzed sample, the PHP payload was Base64-encoded and declared as though it were a GIF image:

data:image/gif;base64

The actual content, however, was executable code. The file was saved under the name:

Mushr00w_upl.php

This is a web shell designed to receive and upload additional payloads. The apparently harmless MIME type therefore does not prevent execution because the validation does not reliably determine the file’s true nature.

Elementor Pro Bypassed with a Carefully Crafted Array

CVE-2026-32475 affects Elementor Pro up to version 4.2.1. NVD does not specify an exact initial version for the vulnerable branch. The fixed release is 4.2.2.

Exploitation requires a specific configuration on the target site: at least one published Elementor page must contain a Form widget with a File Upload field. The attack remains unauthenticated, but this prerequisite explains the higher complexity reflected in the CVSS vector.

The bypass abuses the way the upload field is structured. The attacker submits it as an array: the first element is left empty, while the second contains the PHP payload and a filename ending in the .php extension.

This construction bypasses validation. The plugin then writes the file to:

/wp-content/uploads/elementor/forms/

The filename is generated randomly, but the attacker-controlled .php extension is preserved. At that point, directly requesting the file is enough to execute commands on the server.

Patchstack disclosed details of CVE-2026-32475 last month. The activity observed afterward confirms that the technical information has been incorporated into real-world campaigns, rather than being limited to proof-of-concept testing.

From Web Shell to Complete Site Takeover

The immediate effect of both vulnerabilities is the ability to place PHP code in a web-accessible location. From there, the impact depends on the privileges of the account running PHP and the hosting environment’s configuration.

A web shell can be used to:

• upload malware and additional tools;
• execute arbitrary commands on the system;
• modify themes, plugins, and configurations;
• create WordPress accounts with administrative privileges;
• read credentials and data stored in the database;
• alter or delete content;
• maintain persistent access to the server;
• compromise other sites hosted in the same environment if isolation is insufficient.

Updating the plugin closes the vulnerability but does not remove files already uploaded or accounts created by the attacker. Sites that remained exposed during the campaigns therefore require a retrospective review in addition to patching.

The available NVD entries do not indicate that CVE-2026-14894 or CVE-2026-32475 have been added to the CISA Known Exploited Vulnerabilities catalog. It is therefore not possible to provide a CISA listing date or deadline. There is also insufficient evidence to link these incidents to other recent incidents involving the two vendors in KEV.

The absence of a known KEV status does not reduce the urgency, however: exploitation has been directly documented through hundreds of thousands of malicious requests.

Patches and Checks to Perform Immediately

Administrators of WordPress installations should immediately update:

• Super Forms to version 6.3.314 or later;
• Elementor Pro to version 4.2.2 or later.

They should also check for disabled or outdated copies of the plugins. An unused component that remains on the server may still contain vulnerable code and expand the exposed attack surface.

For Elementor Pro, inspect the following directory in particular:

/wp-content/uploads/elementor/forms/

Look for unexpected PHP files, as well as files added or modified recently, without limiting the search to known filenames. For Super Forms, HTTP logs should be reviewed for requests to:

/wp-admin/admin-ajax.php

More specific indicators include the super_submit_form action, the filename Mushr00w_upl.php, PHP payloads encoded in Base64, and uploads declared as image/gif but saved with a .php extension.

Administrators should also check for:

• new WordPress accounts with elevated privileges;
• unauthorized changes to plugins, themes, and configuration files;
• abnormal PHP processes or requests directed at upload directories;
• unusual outbound connections from the server;
• changes to credentials, content, or site settings.

Observed IP Addresses and Response to a Potential Compromise

The following sources have been associated with attacks against Super Forms:

103.168.147.235
103.168.146.131
103.154.152.178
103.170.97.7
182.10.130.51
189.4.122.140
129.227.46.143
64.176.209.104
103.164.182.122
37.9.33.62

The following addresses were observed in attacks against Elementor Pro:

2602:fa59:10:7a1::1
185.196.220.85
103.84.230.85
103.90.148.202
216.126.225.208
167.254.240.75
167.254.241.119
114.10.17.253
114.10.45.151
2406:ef80:2:7d19::1

These addresses can be blocked or monitored, but they should not become the sole detection criterion. Infrastructure can change, be shared, or be compromised itself.

If signs of intrusion are found, remove web shells, restore files from trusted backups, and rotate credentials for WordPress, hosting, FTP/SFTP, databases, and APIs. Simply deleting the visible payload does not guarantee remediation: the attacker may have established additional persistence mechanisms.