Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

The Hacker News ()2 min read2
Read at thehackernews.com
AI summary · glm-5.3-flashSummaries by Vani AI

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

Key facts
  • CVE-2026-14894: Super Forms missing file type validation, CVSS 9.8
  • CVE-2026-32475: Elementor Pro upload bypass, fixed in 4.2.2
  • Attackers deploy Mushr00w_upl.php PHP web shell via Base64 uploads
  • Super Forms exploitation peaked at 40,000+ requests on August 18
  • Admins urged to patch, scan for IOCs, and audit unexpected .php files
Analyze CVE-2026-14894 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-14894CVE-2026-32475
Tags
arbitrary-file-uploadelementor-proexploitationrcesuper-formsweb-shellwordfencewordpress
Vendors
WordfencePatchstackElementor
Products
Super FormsElementor ProWordPress
Malware
Mushr00w_upl.php
Organizations
Wordfence

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-14894
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the…
9.83%PoC
CVE-2026-32475
Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
9.02%

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv4103.154.152.178he following IP addresses - 103.168.147.235 103.168.146.131 103.154.152.178 103.170.97.7 182.10.130.51 189.4.122.140 129.227.46.143 64.
ipv4103.164.182.1227 182.10.130.51 189.4.122.140 129.227.46.143 64.176.209.104 103.164.182.122 37.9.33.62 The malicious activity is said to have begun on
ipv4103.168.146.131riginated from the following IP addresses - 103.168.147.235 103.168.146.131 103.154.152.178 103.170.97.7 182.10.130.51 189.4.122.140 12
ipv4103.168.147.235ms plugin have originated from the following IP addresses - 103.168.147.235 103.168.146.131 103.154.152.178 103.170.97.7 182.10.130.51
ipv4103.170.97.7addresses - 103.168.147.235 103.168.146.131 103.154.152.178 103.170.97.7 182.10.130.51 189.4.122.140 129.227.46.143 64.176.209.104 1
ipv4103.84.230.85the below IP addresses - 2602:fa59:10:7a1::1 185.196.220.85 103.84.230.85 103.90.148.202 216.126.225.208 167.254.240.75 167.254.241.1
ipv4103.90.148.202ddresses - 2602:fa59:10:7a1::1 185.196.220.85 103.84.230.85 103.90.148.202 216.126.225.208 167.254.240.75 167.254.241.119 114.10.17.25
ipv4114.10.17.2533.90.148.202 216.126.225.208 167.254.240.75 167.254.241.119 114.10.17.253 114.10.45.151 2406:ef80:2:7d19::1 WordPress site owners usi
ipv4114.10.45.15116.126.225.208 167.254.240.75 167.254.241.119 114.10.17.253 114.10.45.151 2406:ef80:2:7d19::1 WordPress site owners using the two plu
ipv4129.227.46.14331 103.154.152.178 103.170.97.7 182.10.130.51 189.4.122.140 129.227.46.143 64.176.209.104 103.164.182.122 37.9.33.62 The malicious act
ipv4167.254.240.75185.196.220.85 103.84.230.85 103.90.148.202 216.126.225.208 167.254.240.75 167.254.241.119 114.10.17.253 114.10.45.151 2406:ef80:2:7d1
ipv4167.254.241.119103.84.230.85 103.90.148.202 216.126.225.208 167.254.240.75 167.254.241.119 114.10.17.253 114.10.45.151 2406:ef80:2:7d19::1 WordPress s
ipv4182.10.130.5103.168.147.235 103.168.146.131 103.154.152.178 103.170.97.7 182.10.130.51 189.4.122.140 129.227.46.143 64.176.209.104 103.164.182.122
ipv4185.196.220.85riginated from the below IP addresses - 2602:fa59:10:7a1::1 185.196.220.85 103.84.230.85 103.90.148.202 216.126.225.208 167.254.240.75
ipv4189.4.122.140103.168.146.131 103.154.152.178 103.170.97.7 182.10.130.51 189.4.122.140 129.227.46.143 64.176.209.104 103.164.182.122 37.9.33.62 Th
ipv4216.126.225.208:fa59:10:7a1::1 185.196.220.85 103.84.230.85 103.90.148.202 216.126.225.208 167.254.240.75 167.254.241.119 114.10.17.253 114.10.45.151
ipv437.9.33.62189.4.122.140 129.227.46.143 64.176.209.104 103.164.182.122 37.9.33.62 The malicious activity is said to have begun on July 14, 20
ipv464.176.209.104178 103.170.97.7 182.10.130.51 189.4.122.140 129.227.46.143 64.176.209.104 103.164.182.122 37.9.33.62 The malicious activity is said t

From the original article

2 min read at thehackernews.com

Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9. 8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including

The Hacker News

thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.