**Critical RCE Vulnerabilities Found in Popular WordPress Plugins Put Thousands of Sites at Risk**
Two severe security flaws in widely used WordPress plugins are currently being exploited by malicious actors to take control of websites. The vulnerabilities affect Super Forms – Drag & Drop Form Builder and Elementor Pro, allowing unauthenticated attackers to upload malicious files and execute arbitrary code on compromised servers.
The first vulnerability, designated CVE-2026-14894, carries a critical CVSS score of 9.8 and impacts the Super Forms plugin. The issue stems from a missing file type validation mechanism, which permits attackers to upload files of any type, including executable PHP scripts. When successfully exploited, the vulnerability leads directly to remote code execution. The flaw was addressed in version 6.3.314 of the plugin.
Attackers are leveraging this flaw by sending HTTP POST requests to the “/wp-admin/admin-ajax.php” endpoint using the “super_submit_form” action. They include a Base64-encoded PHP payload along with a file named “Mushr00w_upl.php.” Once the file is accepted by the server, the web shell enables attackers to upload additional payloads, create administrator accounts, and exfiltrate sensitive data. The malicious activity targeting this flaw began on July 14, 2026, eventually peaking with over 40,000 exploit requests on August 18, 2026.
The second vulnerability, CVE-2026-32475, affects Elementor Pro and carries a CVSS score of 9.0/9.8. Similar to the Super Forms flaw, it allows unauthenticated attackers to upload files of any type, including PHP scripts, resulting in remote code execution. The vulnerability was patched in version 4.2.2.
To exploit this flaw, an attacker must target a site with a published Elementor page containing a Form widget equipped with a File Upload field. The attacker submits the form’s upload field as an array, with the first element empty and the second containing a PHP payload with a “.php” extension. This specific structure bypasses the validation checks. The malicious file is then stored in the “/wp-content/uploads/elementor/forms/” directory under a randomly generated name but retains the attacker-supplied “.php” extension. The attacker can then request this file directly to execute commands on the server. Exploitation of this flaw commenced on August 19, 2026.
Security teams have reported massive-scale intrusion attempts against both flaws, with over 250,000 exploit attempts blocked for CVE-2026-14894 and more than 190,000 for CVE-2026-32475.
**Recommendations**
WordPress site owners using either Super Forms or Elementor Pro must update the plugins to the latest patched versions immediately. Additionally, administrators should thoroughly scan their websites for indicators of compromise and audit their file directories for any unexpected or recently modified PHP files.
***
**FAQ**
**Q1: What does CVSS stand for and what does a score of 9.8 mean?**
A1: CVSS stands for Common Vulnerability Scoring System. It is a standardized framework used to assess the severity of security vulnerabilities. A score of 9.8 falls on the extreme end of the scale, indicating a critical vulnerability that is easily exploitable and can result in complete system compromise.
**Q2: What is a web shell?**
A2: A web shell is a malicious script uploaded to a web server that allows an attacker to execute commands remotely. It acts as a backdoor, enabling the attacker to navigate the file system, steal data, or upload additional malware without the need for further authentication.
**Q3: How can I tell if my WordPress site has been compromised by these vulnerabilities?**
A3: Signs of compromise include the presence of unfamiliar PHP files in the upload directories, newly created user accounts with administrator privileges, unexpected changes to core WordPress files, or a sudden spike in server resource usage. Regular security scans and file integrity checks are essential for early detection.
**Q4: Are all versions of Super Forms and Elementor Pro affected?**
A4: No. Only specific versions are vulnerable. For Super Forms, all versions prior to 6.3.314 are at risk. For Elementor Pro, all versions prior to 4.2.2 are susceptible. Updating to the specified fixed versions or later eliminates the vulnerability.
***
**Conclusion**
The active exploitation of these two critical vulnerabilities highlights the ongoing threats facing WordPress websites, particularly those relying on third-party plugins for core functionality. File upload flaws remain one of the most dangerous vectors for attackers, as they provide a direct path to server-level control. By ensuring all plugins are updated promptly and maintaining a vigilant security posture through regular audits, website administrators can effectively neutralize these threats and protect their digital assets from unauthorized takeover.
Thank you for reading
