Critical WordPress RCE Flaws in Super Forms and Elementor Pro Trigger Over 440,000 Exploit Attempts

Meta Description: Threat actors are actively exploiting critical remote code execution (RCE) vulnerabilities in the WordPress plugins Super Forms and Elementor Pro, with more than 440,000 exploit attempts blocked so far. Here’s how the exploits work, who’s behind the traffic, and how to patch and check for compromise.

Two of WordPress’s most popular form-building plugins, Super Forms – Drag & Drop Form Builder and Elementor Pro, are under active, coordinated attack. Wordfence says it has blocked more than 440,000 exploit attempts against critical remote code execution (RCE) vulnerabilities in the two plugins.

Both flaws let unauthenticated attackers bypass file upload restrictions, execute arbitrary PHP code, and take full control of a compromised site. With both campaigns still active and attackers dropping web shells, site administrators need to patch now and check for existing compromise.

The vulnerabilities at a glance

Both vulnerabilities come down to improper validation of user-supplied file uploads. Because the plugins don’t strictly enforce file extensions and MIME types, attackers can upload executable PHP scripts.

• CVE-2026-14894 (Super Forms): Carries a critical CVSS score of 9.8. The flaw comes from missing file type validation, letting unauthenticated attackers upload files of any type, including executable PHP files. Fixed in version 6.3.314.
• CVE-2026-32475 (Elementor Pro): CVSS 9.0, rising to 9.8 in some environments. This flaw also allows unauthenticated arbitrary file uploads leading to RCE, but only on sites with at least one published Elementor page that has a Form widget with an active File Upload field. Fixed in version 4.2.2.

Exploiting either flaw lets an attacker write a PHP web shell to the server. From there, they can create rogue admin accounts, pull data from the database, deploy ransomware, or fold the server into a botnet.

Technical deep dive: Super Forms RCE (CVE-2026-14894)

The exploitation of CVE-2026-14894 relies on a classic MIME-type spoofing technique combined with a backend extension-validation failure. Threat actors are sending crafted HTTP POST requests to the /wp-admin/admin-ajax.php endpoint, specifically targeting the super_submit_form action.

The payload and execution flow

Attackers construct a multipart form-data request where the file field carries a Base64-encoded PHP payload, prefixing it with a fake image MIME type (data:image/gif;base64) to slip past surface-level frontend or WAF checks. The actual file name in the request, though, is set to a PHP extension, such as Mushr00w_upl.php.

Because Super Forms fails to validate the actual file extension against the declared MIME type, the server processes and saves the file as an executable PHP script.

Below is a reconstructed analysis of the malicious HTTP POST request observed in the wild:

http

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
action=super_submit_form&form_id=2&sf_nonce=[VALID_NONCE]&data={"sf_upload_field": {"type": "files", "files": [{"datauristring": "data:image/gif;base64,[BASE64_PAYLOAD]", "value": "Mushr00w_upl.php", "name": "Mushr00w_upl.php", "label": "attachment"}]}}

Analyzing the “Mushr00w” web shell

Decoding the Base64 payload reveals a fully functional, if stylized, PHP file uploader known as “Mushr00w.” The decoded script uses the $_FILES superglobal to accept a secondary file upload, moves it to the current directory with move_uploaded_file(), and outputs a success message with a clickable link to the newly uploaded file.

That secondary uploader points to a chained attack: the initial exploit drops the Mushr00w shell, which then gives the attacker a browser-based interface for uploading heavier, persistent payloads, such as database dumpers, cryptominers, or lateral-movement scripts, without needing to rebuild raw HTTP requests by hand.

Technical deep dive: Elementor Pro RCE (CVE-2026-32475)

The exploitation mechanism for CVE-2026-32475 is a bit more involved: it relies on a type-juggling or array-index assumption vulnerability in the plugin’s file validation logic. Patchstack first published details of the flaw, which likely accelerated the wave of attacks that followed.

The array manipulation bypass

To bypass Elementor Pro’s file type validation, attackers submit the File Upload field not as a standard file object but as an array. The array is built specifically to break the plugin’s validation checks.

The malicious array is structured with at least two elements:

1. Index 0: An empty value or null.
2. Index 1: The actual PHP payload, complete with a .php file extension.

The vulnerability lies in how the plugin’s backend code processes this array. The validation routine likely checks the first element (Index 0) for file properties, finds it empty, and either skips validation or assumes the file is safe. Meanwhile, the payload in Index 1 goes straight to the file-writing function without the same checks.

File placement and execution

Once validation is bypassed, the plugin writes the uploaded file to the /wp-content/uploads/elementor/forms/ directory. To avoid detection and filename collisions, it generates a random alphanumeric filename and appends the attacker-supplied .php extension (e.g., x8f9a2b3c4d5.php).

Because the /wp-content/uploads/ directory is typically configured to allow direct public access, the attacker only needs to send a simple HTTP GET request to the newly generated file path to execute arbitrary commands on the server.

Threat intelligence and campaign timelines

Wordfence’s data shows each vulnerability has its own attack timeline and infrastructure.

Super Forms campaign (CVE-2026-14894)

Exploitation attempts against the Super Forms vulnerability began on July 14, 2026, and activity spiked at more than 40,000 exploit requests in a single day on August 18. Wordfence blocked over 250,000 attempts in total.

The infrastructure behind this campaign is heavily IPv4-based, spread across a distributed network of servers. Notable source IPs include:

• 103.168.147.235, 103.168.146.131, 103.154.152.178
• 103.170.97.7, 182.10.130.51, 189.4.122.140
• 129.227.46.143, 64.176.209.104, 103.164.182.122, 37.9.33.62

Elementor Pro campaign (CVE-2026-32475)

Attacks against Elementor Pro began shortly after the vulnerability details went public, on August 19, 2026. Wordfence blocked over 190,000 attempts.

The Elementor campaign’s infrastructure mixes IPv6 with IPv4, a shift that suggests more diversified, possibly more modern, botnet infrastructure. Source IPs include:

• IPv6: 2602:fa59:10:7a1::1, 2406:ef80:2:7d19::1
• IPv4: 185.196.220.85, 103.84.230.85, 103.90.148.202, 216.126.225.208, 167.254.240.75, 167.254.241.119, 114.10.17.253, 114.10.45.151

Impact and real-world consequences

Because both flaws are unauthenticated, attackers don’t need to phish credentials or brute-force passwords first. Once an automated scanner flags a vulnerable site, it can be compromised within seconds.

Once an attacker has RCE, they hold the same privileges as the web server process (typically the www-data user). That’s not root access, but it’s enough to:

1. Deface the website or inject spam links for SEO manipulation.
2. Pull data from the WordPress database, including customer PII, hashed passwords, and payment information.
3. Deploy secondary malware, such as cryptominers that drain server resources or backdoors that keep access open even after the vulnerability is patched.
4. Pivot to other services on the same server or network.

Mitigation and remediation guide

To protect their sites and clean up any compromise, WordPress administrators should work through the following steps.

1. Immediate patching

The most important step is updating the affected plugins to their patched versions.

• Update Super Forms to version 6.3.314 or higher.
• Update Elementor Pro to version 4.2.2 or higher.
• Note: If you’re on managed WordPress hosting, make sure automatic background updates are enabled, or contact your host to apply these patches right away.

2. Indicator of Compromise (IoC) hunting

Patching stops future attacks, but it doesn’t remove existing web shells. Administrators need to manually audit their file systems for signs of compromise.

• Check the upload directories. Inspect /wp-content/uploads/elementor/forms/ and the default Super Forms upload directories for .php, .phtml, or .phar files. Those directories should hold only media files: images, PDFs, documents.
• Search for “Mushr00w.” Look across the web root for files named Mushr00w_upl.php or containing the string Mushr00w.
• Check file modification times. On a Linux server, find /var/www/html -name "*.php" -mtime -7 finds PHP files modified in the last seven days.

3. Implement Web Application Firewall (WAF) rules

If you can’t patch right away, or want defense in depth, add WAF rules to block these exploit patterns.

• If Super Forms isn’t actively in use, block admin-ajax.php requests carrying the action=super_submit_form parameter.
• Configure your WAF (Cloudflare, AWS WAF, Wordfence, or similar) to inspect multipart form-data uploads and block any request where the file extension doesn’t match an allowed list, such as .jpg, .png, .pdf.

4. Post-compromise incident response

If you find a web shell, or suspect a breach happened before you patched, assume the environment is fully compromised.

• Change all WordPress admin passwords, database user passwords, and FTP/SFTP credentials right away.
• Check the WordPress wp_users table for admin accounts the attacker may have created.
• If the extent of the compromise isn’t clear, restore from a known clean backup taken before July 14, 2026, then apply the plugin updates before bringing the site back online.

Conclusion

Arbitrary file upload flaws remain one of the more direct paths to full compromise in CMS plugins, and the volume here, over 440,000 blocked attempts across two campaigns, shows how quickly automated scanners find and hit exposed sites once a vulnerability goes public. Patching alone won’t undo an existing compromise: administrators running Super Forms or Elementor Pro should check their upload directories for planted shells regardless of when they update.