Affected Systems

WordPress plugins: Super Forms – Drag & Drop Form Builder (fixed in 6.3.314) and Elementor Pro (fixed in 4.2.2). CVE-2026-14894 affects all unauthenticated users; CVE-2026-32475 requires at least one published Elementor page with Form widget containing File Upload field. Over 440,000 exploit attempts detected across both vulnerabilities.

Exploitation Status

Active exploitation confirmed. Wordfence blocked 250,000+ attempts against CVE-2026-14894 (since July 14, 2026) and 190,000+ against CVE-2026-32475 (since August 19, 2026). Attackers deploying PHP web shells to create admin accounts, exfiltrate data, and seize site control.

Business Impact

Unauthenticated remote code execution allows complete WordPress site compromise. Attackers upload PHP web shells via missing file type validation, enabling arbitrary code execution, administrator account creation, data exfiltration, and full site takeover. CVE-2026-14894 (CVSS 9.8) requires no preconditions; CVE-2026-32475 (CVSS 9.0-9.8) requires specific Elementor form configuration. Both vulnerabilities are trivial to exploit with known attack patterns and source IPs published.

Urgency

🔴 Immediate

Recommended Actions

  • Update Super Forms to version 6.3.314 or later and Elementor Pro to version 4.2.2 or later immediately on all WordPress installations
  • Scan wp-content/uploads/ directories (especially /elementor/forms/) for unexpected or recently modified .php files; check for 'Mushr00w_upl.php' and similar web shells
  • Review WordPress administrator accounts for unauthorized additions created after July 14, 2026; audit user creation logs in WordPress database
  • Block known attacker IP addresses at firewall/WAF: 103.168.147.235, 103.168.146.131, 103.154.152.178, 103.170.97.7, 182.10.130.51, 189.4.122.140, 129.227.46.143, 64.176.209.104, 103.164.182.122, 37.9.33.62, 185.196.220.85, 103.84.230.85, 103.90.148.202, 216.126.225.208, 167.254.240.75, 167.254.241.119, 114.10.17.253, 114.10.45.151
  • Monitor web server logs for POST requests to /wp-admin/admin-ajax.php with 'super_submit_form' action or unusual file uploads to Elementor form endpoints; alert on Base64-encoded payloads in form submissions