RCE Attacks via Super Forms and Elementor Pro File Upload Bugs

Two critical vulnerabilities in the popular WordPress plugins Super Forms (CVE-2026-14894, CVSS 9.8) and Elementor Pro (CVE-2026-32475, CVSS 9.8) are being actively exploited by attackers to upload executable PHP files and achieve remote code execution. According to Wordfence, more than 440,000 exploitation attempts have been blocked in total. Site owners using these plugins must immediately update Super Forms to version 6.3.314 and Elementor Pro to version 4.2.2, and also check their sites for indicators of compromise.

Technical details of the vulnerabilities

Both vulnerabilities fall into the class of unauthenticated arbitrary file upload — the attacker does not need an account on the site to carry out the attack.

CVE-2026-14894 — Super Forms

CVE-2026-14894 affects the Super Forms – Drag & Drop Form Builder plugin, versions up to and including 6.3.313. The vulnerability is caused by the lack of validation of uploaded file types, which allows an unauthenticated attacker to upload a file of any type, including executable PHP scripts. The CVSS score is 9.8 (critical). It is fixed in version 6.3.314.

According to Wordfence, in observed attacks the threat actors send an HTTP POST request to /wp-admin/admin-ajax.php with the action super_submit_form. The payload is PHP code encoded in Base64 and disguised as an image using the data:image/gif;base64 prefix. The file name is controlled by the attacker — in recorded cases the name Mushr00w_upl.php was used. This file is a web shell for file uploads, which then serves as an entry point for delivering additional malicious components.

According to the researchers, active exploitation began on July 14, 2026 and peaked on August 18, 2026 — with more than 40,000 requests in a single day. In total, Wordfence has blocked over 250,000 attempts to exploit this vulnerability.

CVE-2026-32475 — Elementor Pro

CVE-2026-32475 affects Elementor Pro versions up to and including 4.2.1. The vulnerability makes it possible to bypass file upload validation in the form widget with a file upload field. The CVSS score is 9.8 (critical). It is fixed in version 4.2.2.

Successful exploitation requires that the target site has at least one published page with an Elementor Pro form widget that includes an optional file upload field. As reported by Wordfence, the attacker sends the file upload field as an array, where the first element is empty and the second contains the PHP payload with a .php extension. This structure causes an early return from the validation function, skipping checks of the file extension and type.

The uploaded PHP file is placed in the /wp-content/uploads/elementor/forms/ directory with a randomly generated name, but with the .php extension specified by the attacker. The attacker then accesses the file directly to execute arbitrary commands on the server.

According to the researchers, exploitation of this vulnerability began on August 19, 2026. Wordfence has blocked more than 190,000 attack attempts.

Consequences of successful exploitation

Successful exploitation of either vulnerability allows an attacker to place an executable PHP file — a web shell — on the site, through which it is possible to:

• Execute arbitrary commands on the server
• Create administrator accounts
• Extract data from the site’s database
• Fully take over control of the WordPress site
• Use the compromised server as a foothold for further attacks

Given the scale of the WordPress ecosystem and the prevalence of both plugins, the potential attack surface is significant. E-commerce sites, corporate portals, and resources processing personal data via forms are at particular risk.

Threat context and attribution

Wordfence notes that the “Mushr00w” branding in the uploader used in attacks on Super Forms resembles markings linked to another incident. However, the researchers explicitly warn that this branding match alone is insufficient to tie the activity to any specific group — such markers are easy to forge or borrow. Reliable attribution is currently lacking.

It should also be taken into account that the figures given (250,000 and 190,000 blocked attempts) reflect Wordfence firewall telemetry and represent blocked requests, not confirmed compromises. The actual number of successfully compromised sites is unknown.

Indicators of compromise

IP addresses observed in attacks on Super Forms:

• 103.168.147.235
• 103.168.146.131
• 103.154.152.178
• 103.170.97.7
• 182.10.130.51
• 189.4.122.140
• 129.227.46.143
• 64.176.209.104
• 103.164.182.122
• 37.9.33.62

IP addresses observed in attacks on Elementor Pro:

• 2602:fa59:10:7a1::1
• 185.196.220.85
• 103.84.230.85
• 103.90.148.202
• 216.126.225.208
• 167.254.240.75
• 167.254.241.119
• 114.10.17.253
• 114.10.45.151
• 2406:ef80:2:7d19::1

Additional indicators to look for on the server:

• The file Mushr00w_upl.php or any other unexpected PHP files in upload directories
• Any PHP files in the /wp-content/uploads/elementor/forms/ directory (this directory is intended for form data, not executable scripts)
• POST requests to /wp-admin/admin-ajax.php with the actions super_submit_form or elementor_pro_forms_send_form from unauthenticated users

Response recommendations

1. Immediately update Super Forms to version 6.3.314 and Elementor Pro to version 4.2.2
2. Check upload directories for unexpected PHP files, especially /wp-content/uploads/ and /wp-content/uploads/elementor/forms/
3. Analyze access logs for POST requests to admin-ajax.php with the specified actions from the listed IP addresses
4. Review the list of WordPress administrators for unknown or recently created accounts
5. Block the listed IP addresses at the WAF or network firewall level
6. If signs of compromise are found, perform a full site scan for backdoors, delete malicious files, and change all administrator passwords

Both vulnerabilities represent the maximum level of risk due to the combination of three factors: no authentication required, the possibility of remote code execution, and confirmed active exploitation. If your site is running Super Forms below version 6.3.314 or Elementor Pro below version 4.2.2, updating must be treated as a top priority — ahead of any other maintenance tasks. With the current intensity of attacks (tens of thousands of attempts per day), delaying patching significantly increases the likelihood of compromise.