Full Report
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including
Analysis Summary
# Vulnerability: Critical RCE in Super Forms and Elementor Pro WordPress Plugins
## CVE Details
- **CVE ID:** CVE-2026-14894 / CVE-2026-32475
- **CVSS Score:** 9.8 (Critical) / 9.0-9.8 (Critical)
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
## Affected Systems
- **Products:**
1. Super Forms – Drag & Drop Form Builder (WordPress Plugin)
2. Elementor Pro (WordPress Plugin)
- **Versions:**
1. Super Forms: All versions prior to 6.3.314
2. Elementor Pro: All versions prior to 4.2.2
- **Configurations:**
- For Elementor Pro, the site must have at least one published page containing a "Form widget" with a "File Upload" field enabled.
## Vulnerability Description
Both vulnerabilities stem from a failure to properly validate file types during the upload process.
- **Super Forms:** The plugin lacks file type validation, allowing unauthenticated users to upload executable files (e.g., PHP) via the `super_submit_form` AJAX endpoint.
- **Elementor Pro:** Attackers can bypass validation by submitting the File Upload field as an array where the first element is empty and the second carries the PHP payload, confusing the validation logic.
## Exploitation
- **Status:** Exploited in the wild (Over 440,000 combined attempts blocked by Wordfence).
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full data exfiltration possible)
- **Integrity:** High (Ability to create admin accounts and modify site content)
- **Availability:** High (Potential for total site takeover/deletion)
## Remediation
### Patches
- **Super Forms:** Update to version **6.3.314** or higher.
- **Elementor Pro:** Update to version **4.2.2** or higher.
### Workarounds
- Disable or remove the File Upload field from public-facing forms if an update cannot be immediately applied.
- Restrict access to `wp-admin/admin-ajax.php` if not required for public users (though this may break site functionality).
## Detection
- **Indicators of Compromise (IoCs):**
- Filenames: `Mushr00w_upl.php`
- Directory paths: `/wp-content/uploads/elementor/forms/`
- Post requests to: `/wp-admin/admin-ajax.php` with `action=super_submit_form`.
- **Known Attacking IPs:**
- 103[.]168[.]147[.]235
- 103[.]168[.]146[.]131
- 103[.]154[.]152[.]178
- 103[.]170[.]97[.]7
- 182[.]10[.]130[.]51
- 189[.]4[.]122[.]140
- 129[.]227[.]46[.]143
- 64[.]176[.]209[.]104
- 103[.]164[.]182[.]122
- 37[.]9[.]33[.]62
## References
- **Vendor Advisory:** hxxps://www[.]wordfence[.]com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/
- **Vendor Advisory:** hxxps://www[.]wordfence[.]com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-elementor-pro-plugin/
- **News Source:** hxxps://thehackernews[.]com/2026/09/over-440000-exploit-attempts-target.html