CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack

Wordfence has blocked over 440,000 exploit attempts against two actively exploited WordPress plugin vulnerabilities in barely two months. CVE-2026-14894 affects Super Forms (Drag & Drop Form Builder), a plugin Wordfence estimates has around 13,000 active installations. The flaw lets unauthenticated attackers upload arbitrary files, including PHP, well before most site owners can patch.

A second flaw, CVE-2026-32475, hits Elementor Pro’s Forms module similarly. Both vulnerabilities converge on the same outcome: attacker-controlled PHP code lands on the server without a login step. Wordfence recorded over 250,000 attempts against Super Forms and over 190,000 against Elementor Pro.

These are not theoretical risks. Attackers have already deployed a working PHP web shell against Super Forms sites. A separate validation bypass targets Elementor Pro. Enterprises running either plugin need patch verification, web shell hunting, and administrator account review right now.

How CVE-2026-14894 turns a contact form into a Web Shell drop point

Super Forms’ submit_form nopriv AJAX handler skips file-type validation and capability checks entirely. Attackers first call a separate nopriv action, super_create_nonce, which issues a valid nonce to any unauthenticated visitor.

Both super_create_nonce and super_submit_form are registered under WordPress’s wp_ajax_nopriv_ hooks, which is what allows them to run without a logged-in session or valid capability check.

They send that nonce to super_submit_form via a POST request to /wp-admin/admin-ajax.php, with a file field carrying a Base64-encoded payload prefixed as data:image/gif;base64. The prefix decodes to a PHP script, not an image. Wordfence observed the resulting file, named Mushr00w_upl.php, functioning as a web shell that lets attackers push further payloads without repeating the exploit.

• Super Forms shipped the fix in version 6.3.314 in early July 2026.
• Wordfence publicly disclosed the flaw on July 9, 2026.
• Exploitation began July 14, 2026, the same day Wordfence issued a firewall rule for Premium, Care, and Response customers.
• Exploit volume peaked at more than 40,000 requests on August 18, 2026, with the most intense activity running through August 25.
• Wordfence has blocked more than 250,000 exploit attempts against CVE-2026-14894 in total.

The validation desync behind CVE-2026-32475

Patchstack found that Elementor Pro’s Forms module handles File Upload validation and file moving in two separate loops, each treating empty entries differently. Attackers exploit this by submitting the field as a two-part array: an empty first element, then a PHP payload.

This bypasses validation, and the file lands in /wp-content/uploads/elementor/forms/ under a uniqid()-based filename, time-based rather than random, keeping the attacker’s .php extension. Attackers then request it directly to execute code.

Exploitation requires a published Elementor page with a Form widget containing a File Upload field. Patchstack rates the flaw 9.0, citing high complexity; Wordfence assesses it at 9.8. Both call it a critical, unauthenticated RCE.

• Patchstack disclosed the flaw ahead of the vendor fix.
• Elementor Pro shipped version 4.2.2 to close the gap on August 19, 2026.
• Exploitation began on August 19, 2026.
• Wordfence has blocked more than 190,000 exploit attempts against CVE-2026-32475 in total.

Exploitation at a glance

What a successful upload enables

Both flaws share the same downstream impact once a PHP file lands on disk.

• Execute arbitrary PHP commands on the compromised server
• Create unauthorized administrator accounts inside WordPress
• Exfiltrate site data, including form submissions and stored credentials
• Deploy additional malware or secondary web shells
• Take full control of the WordPress installation

Patch, verify, and hunt: What to do now

Patching stops new exploitation, but it doesn’t undo what already happened. Verification and hunting close the rest of the gap.

Server-Side Remediation

• Update Super Forms to version 6.3.314 or later immediately.
• Update Elementor Pro to version 4.2.2 or later immediately.
• Scan /wp-content/uploads/ and /wp-content/uploads/elementor/forms/ for unexpected .php files.
• Review recent WordPress administrator accounts for unauthorized additions.
• Check web server logs for POST requests to admin-ajax.php with the super_submit_form action.
• Check logs for direct requests to newly created files inside the Elementor forms upload directory.

Endpoint & Identity Controls

• Rotate site credentials and API keys if any indicator of compromise appears.
• Verify that administrators’ own endpoints run current browser and OS updates.

Patching Super Forms and Elementor Pro remediates the plugin-level flaw only. Confirm affected WordPress installations run the patched versions. Verify that administrators’ own endpoints run current browser and OS updates too. Server patching and endpoint patching are not the same control.

Featured resource

Cybersecurity kit

Free cybersecurity kit: blueprint, framework guide, IT checklist, incident policy template, UEM infographic, and management guides.

DOWNLOAD

Hexnode’s Role for WordPress Administrators

Hexnode does not patch third-party plugins or monitor WordPress application logs. Its role sits with the administrators who manage these sites, not the server itself. Three parts of the platform apply here: XDR, UEM, and IdP.

XDR

• Hexnode XDR investigates suspicious activity on managed endpoints, primarily Windows and macOS.
• It supports one-click containment, isolating a device or killing a malicious process, if an administrator’s endpoint shows signs of compromise.

UEM

• Hexnode UEM enforces OS, browser, and patch compliance across Android, iOS/iPadOS, Windows, macOS, Fire OS, tvOS, visionOS, Linux, and ChromeOS devices that administrators use to manage CMS platforms.
• It reports compliance data to Microsoft Entra ID for Android, iOS, and macOS devices, supporting Conditional Access policies that restrict CMS administration to trusted, compliant devices.

IdP

• Hexnode IdP federates with identity providers like Microsoft Entra ID and Google Workspace to govern application access and SSO for hosting and CMS consoles.
• It blocks rooted, jailbroken, or unencrypted devices from accessing connected applications, using device posture pulled from UEM.

Conclusion

The exploitation volume behind CVE-2026-14894 and CVE-2026-32475 confirms that patch delay carries real cost. Attackers scaled a working web shell against Super Forms within days of disclosure. They moved on Elementor Pro just as quickly. Waiting for a quiet week to patch is no longer a safe assumption for public-facing WordPress plugins.

Site owners running either plugin should patch now, hunt for unfamiliar PHP files, and audit administrator accounts for unauthorized changes. Pairing that work with endpoint compliance for the people who manage these sites closes a real gap. Patching the plugin alone does not cover that gap.