{"id":1421,"date":"2026-09-07T14:22:22","date_gmt":"2026-09-07T08:52:22","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1421"},"modified":"2026-09-08T11:07:31","modified_gmt":"2026-09-08T05:37:31","slug":"cve-2026-14894-super-forms-elementor-pro-rce-under-attack","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/","title":{"rendered":"CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack"},"content":{"rendered":"<p>Wordfence has blocked over 440,000 exploit attempts against two actively exploited WordPress plugin <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-vulnerability-in-cybersecurity\/\">vulnerabilities<\/a> in barely two months. CVE-2026-14894 affects Super Forms (Drag &amp; Drop Form Builder), a plugin Wordfence estimates has around 13,000 active installations. The flaw lets unauthenticated attackers upload arbitrary files, including PHP, well before most site owners can patch.<\/p>\n<p>A second flaw, <a href=\"https:\/\/www.tenable.com\/cve\/CVE-2026-32475?utm_source=hexnode_blog&amp;utm_medium=referral&amp;utm_campaign=cve_2026_14894\" rel=\"nofollow\">CVE-2026-32475<\/a>, hits Elementor Pro&#8217;s Forms module similarly. Both vulnerabilities converge on the same outcome: attacker-controlled PHP code lands on the server without a login step. Wordfence recorded over 250,000 attempts against Super Forms and over 190,000 against Elementor Pro.<\/p>\n<p>These are not theoretical risks. Attackers have already deployed a working PHP web shell against Super Forms sites. A separate validation bypass targets Elementor Pro. Enterprises running either plugin need patch verification, <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-web-shell\/\">web shell<\/a> hunting, and administrator account review right now.<\/p>\n<p><center>    \t\t<!-- button style scb20be917a3efc78059cf9961ee4e54284 -->\r\n    \t\t<style>\r\n    \t\t\t.scb20be917a3efc78059cf9961ee4e54284, a.scb20be917a3efc78059cf9961ee4e54284{\r\n    \t\t\t\tcolor: #fff;\r\n    \t\t\t\tbackground-color: #00868B;\r\n    \t\t\t}\r\n    \t\t\t.scb20be917a3efc78059cf9961ee4e54284:hover, a.scb20be917a3efc78059cf9961ee4e54284:hover{\r\n    \t\t\t\t    \t\t\t\tbackground-color: #32b8bd;\r\n    \t\t\t}\r\n    \t\t<\/style>\r\n    \t\t<a href=\"https:\/\/www.hexnode.com\/\" class=\"ht-shortcodes-button scb20be917a3efc78059cf9961ee4e54284  hn-cta__blogs--inline-button \" id=\"\" style=\"\" >\r\n    \t\tBook a free demo and explore Hexnode today!<\/a>\r\n    \t\t<\/center><\/p>\n<h2>How CVE-2026-14894 turns a contact form into a Web Shell drop point<\/h2>\n<p>Super Forms&#8217; submit_form nopriv AJAX handler skips file-type validation and capability checks entirely. Attackers first call a separate nopriv action, super_create_nonce, which issues a valid nonce to any unauthenticated visitor.<\/p>\n<p>Both super_create_nonce and super_submit_form are registered under WordPress&#8217;s wp_ajax_nopriv_ hooks, which is what allows them to run without a logged-in session or valid capability check.<\/p>\n<p>They send that nonce to super_submit_form via a POST request to \/wp-admin\/admin-ajax.php, with a file field carrying a Base64-encoded payload prefixed as <code>data:image\/gif;base64<\/code>. The prefix decodes to a PHP script, not an image. Wordfence observed the resulting file, named Mushr00w_upl.php, functioning as a web shell that lets attackers push further payloads without repeating the exploit.<\/p>\n<ul>\n<li>Super Forms shipped the fix in version 6.3.314 in early July 2026.<\/li>\n<li>Wordfence publicly disclosed the flaw on July 9, 2026.<\/li>\n<li>Exploitation began July 14, 2026, the same day Wordfence issued a firewall rule for Premium, Care, and Response customers.<\/li>\n<li>Exploit volume peaked at more than 40,000 requests on August 18, 2026, with the most intense activity running through August 25.<\/li>\n<li>Wordfence has blocked more than <a href=\"https:\/\/thehackernews.com\/2026\/09\/over-440000-exploit-attempts-target.html?utm_source=hexnode_blog&amp;utm_medium=referral&amp;utm_campaign=cve_2026_14894\" rel=\"nofollow\">250,000<\/a> exploit attempts against CVE-2026-14894 in total.<\/li>\n<\/ul>\n<div class=\"next_blog\"><div class=\"post-next\"><div class=\"hex_blog_box_parent\"><div class=\"blog_warp_next\"><div class=\"next_blog_thumb\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-challenges.jpeg?format=webp)\"><\/div><div class=\"next_post_content\"><div class=\"center_box\"><h4>Top 10 Cybersecurity Challenges for Enterprises<\/h4><p>Top 10 enterprise cybersecurity challenges, risks, and Hexnode's mitigation strategies.<\/p><\/div><\/div><\/div><a class=\"hex_blog_box_link hn-cta__blogs--blog-box\" href=\"https:\/\/www.hexnode.com\/blogs\/top-10-cybersecurity-challenges-for-enterprises\/\" aria-label=\"Top 10 Cybersecurity Challenges for Enterprises\"><\/a><\/div><\/div><\/div>\n<h2>The validation desync behind CVE-2026-32475<\/h2>\n<p>Patchstack found that Elementor Pro&#8217;s Forms module handles File Upload validation and file moving in two separate loops, each treating empty entries differently. Attackers exploit this by submitting the field as a two-part array: an empty first element, then a PHP payload.<\/p>\n<p>This bypasses validation, and the file lands in \/wp-content\/uploads\/elementor\/forms\/ under a uniqid()-based filename, time-based rather than random, keeping the attacker&#8217;s <code>.php<\/code> extension. Attackers then request it directly to execute code.<\/p>\n<p>Exploitation requires a published Elementor page with a Form widget containing a File Upload field. Patchstack rates the flaw 9.0, citing high complexity; Wordfence assesses it at 9.8. Both call it a critical, unauthenticated <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-remote-code-execution-rce\/\">RCE<\/a>.<\/p>\n<ul>\n<li>Patchstack disclosed the flaw ahead of the vendor fix.<\/li>\n<li>Elementor Pro shipped version 4.2.2 to close the gap on August 19, 2026.<\/li>\n<li>Exploitation began on August 19, 2026.<\/li>\n<li>Wordfence has blocked more than 190,000 exploit attempts against CVE-2026-32475 in total.<\/li>\n<\/ul>\n<h3>Exploitation at a glance<\/h3>\n<table style=\"width: 100%;\">\n<thead>\n<tr>\n<th style=\"width: 23.3615%; text-align: left;\">Vulnerability<\/th>\n<th style=\"width: 23.4673%; text-align: left;\">Plugin<\/th>\n<th style=\"width: 22.7272%; text-align: left;\">CVSS<\/th>\n<th style=\"width: 29.1755%; text-align: left;\">Key Operational Risk<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"width: 23.3615%;\">CVE-2026-14894<\/td>\n<td style=\"width: 23.4673%;\">Super Forms (Drag &amp; Drop Form Builder)<\/td>\n<td style=\"width: 22.7272%;\">9.8<\/td>\n<td style=\"width: 29.1755%;\">Unauthenticated PHP web shell upload via admin-ajax.php<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 23.3615%;\">CVE-2026-32475<\/td>\n<td style=\"width: 23.4673%;\">Elementor Pro<\/td>\n<td style=\"width: 22.7272%;\">9.0 (Patchstack) \/ 9.8 (Wordfence)<\/td>\n<td style=\"width: 29.1755%;\">Unauthenticated PHP upload via Forms File Upload field desync<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>What a successful upload enables<\/h2>\n<p>Both flaws share the same downstream impact once a PHP file lands on disk.<\/p>\n<ul>\n<li>Execute arbitrary PHP commands on the compromised server<\/li>\n<li>Create unauthorized administrator accounts inside WordPress<\/li>\n<li>Exfiltrate site data, including form submissions and stored credentials<\/li>\n<li>Deploy additional malware or secondary web shells<\/li>\n<li>Take full control of the WordPress installation<\/li>\n<\/ul>\n<h2>Patch, verify, and hunt: What to do now<\/h2>\n<p>Patching stops new exploitation, but it doesn&#8217;t undo what already happened. Verification and hunting close the rest of the gap.<\/p>\n<h3>Server-Side Remediation<\/h3>\n<ul>\n<li>Update Super Forms to version 6.3.314 or later immediately.<\/li>\n<li>Update Elementor Pro to version 4.2.2 or later immediately.<\/li>\n<li>Scan \/wp-content\/uploads\/ and \/wp-content\/uploads\/elementor\/forms\/ for unexpected .php files.<\/li>\n<li>Review recent WordPress administrator accounts for unauthorized additions.<\/li>\n<li>Check web server logs for POST requests to admin-ajax.php with the super_submit_form action.<\/li>\n<li>Check logs for direct requests to newly created files inside the Elementor forms upload directory.<\/li>\n<\/ul>\n<h3>Endpoint &amp; Identity Controls<\/h3>\n<ul>\n<li>Rotate site credentials and API keys if any <a href=\"https:\/\/www.hexnode.com\/blogs\/explained\/what-is-indicator-of-compromise-ioc\/\">indicator of compromise<\/a> appears.<\/li>\n<li>Verify that administrators&#8217; own endpoints run current browser and OS updates.<\/li>\n<\/ul>\n<p>Patching Super Forms and Elementor Pro remediates the plugin-level flaw only. Confirm affected WordPress installations run the patched versions. Verify that administrators&#8217; own endpoints run current browser and OS updates too. Server patching and endpoint patching are not the same control.<\/p>\n<section id='resource-single'>\n                    <div class='resource-box'>\n                        <div class='resource-box__image-section'>\n                            <div class='resource-box__image-wrap'>\n                                <img decoding=\"async\" src=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit-.jpg?format=webp\" class=\"resource-box__image\" alt=\"cybersecurity kit\" loading=\"lazy\" srcset=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit-.jpg?format=webp 960w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--300x225.jpg?format=webp 300w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--768x576.jpg?format=webp 768w, https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-kit--133x100.jpg?format=webp 133w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" title=\"cybersecurity kit\" \/>\n                            <\/div>\n                        <\/div>\n                        <div class='resource-box__content-section'>\n                            <h5 class='resource-box__content-subheading'>\n                            Featured resource\n                            <\/h5>\n                            <h4 class='resource-box__content-heading'>\n                            Cybersecurity kit\n                            <\/h4>\n                            <p class='resource-box__contents'>\n                            Free cybersecurity kit: blueprint, framework guide, IT checklist, incident policy template, UEM infographic, and management guides.\n                            <\/p>\n                            <a class='resource-box__content-link hn-cta__blogs--resource-box' href='https:\/\/www.hexnode.com\/resources\/resource-kits\/cybersecurity-kit\/'>\n                            DOWNLOAD\n                            <svg xmlns='http:\/\/www.w3.org\/2000\/svg' width='20' height='20' viewBox='0 0 20 20'>\n                            <g id='arrow' transform='translate(-309 -191)' opacity='0'>\n                                <rect id='base' width='20' height='20' transform='translate(309 191)' fill='none'\/>\n                                <path id='arrow-2' data-name='arrow' d='M13.093.5,6.8,6.8.5.5' transform='translate(315 207.594) rotate(-90)' fill='none' stroke='#0549d1' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.2'\/>\n                            <\/g>\n                            <\/svg>\n\n                            <\/a>\n                        <\/div>\n                    <\/div>\n                <\/section>\n<h2>Hexnode&#8217;s Role for WordPress Administrators<\/h2>\n<p>Hexnode does not patch third-party plugins or monitor WordPress application logs. Its role sits with the administrators who manage these sites, not the server itself. Three parts of the platform apply here: XDR, UEM, and IdP.<\/p>\n<h3>XDR<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.hexnode.com\/xdr\/\">Hexnode XDR<\/a> investigates suspicious activity on managed endpoints, primarily Windows and macOS.<\/li>\n<li>It supports one-click containment, isolating a device or killing a malicious process, if an administrator&#8217;s endpoint shows signs of compromise.<\/li>\n<\/ul>\n<h3>UEM<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.hexnode.com\/uem\/\">Hexnode UEM<\/a> enforces OS, browser, and patch compliance across Android, iOS\/iPadOS, Windows, macOS, Fire OS, tvOS, visionOS, Linux, and ChromeOS devices that administrators use to manage CMS platforms.<\/li>\n<li>It reports compliance data to Microsoft Entra ID for Android, iOS, and macOS devices, supporting Conditional Access policies that restrict CMS administration to trusted, compliant devices.<\/li>\n<\/ul>\n<h3>IdP<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.hexnode.com\/idp\/\">Hexnode IdP<\/a> federates with identity providers like Microsoft Entra ID and Google Workspace to govern application access and SSO for hosting and CMS consoles.<\/li>\n<li>It blocks rooted, jailbroken, or unencrypted devices from accessing connected applications, using device posture pulled from UEM.<\/li>\n<\/ul>\n<div class=\"faq-section-wrapper\" itemscope itemtype=\"https:\/\/schema.org\/FAQPage\"><h2 class=\"faq-main-title\">FAQs<\/h2><div class=\"faq-items\"><div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Does updating the plugin remove an existing web shell?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>No. Patching closes the upload flaw going forward, but it does not delete files an attacker already placed on the server. Site owners need to scan for and remove unauthorized PHP files separately.<\/p>\n<\/div><\/div><\/div>\n<div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">Is CVE-2026-32475 exploitable on every Elementor Pro site?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>No. Exploitation requires a published page with an Elementor Form widget that includes a File Upload field. Sites without that specific configuration are not exposed to this attack path.<\/p>\n<\/div><\/div><\/div>\n<div class=\"faq-item\" itemprop=\"mainEntity\" itemscope itemtype=\"https:\/\/schema.org\/Question\"><div class=\"faq-item__question\" role=\"button\" tabindex=\"0\" aria-expanded=\"false\"><span itemprop=\"name\">How can defenders tell if a site was already targeted?<\/span>\n            <div class=\"toggle\" aria-hidden=\"true\"><span><\/span><span><\/span><\/div>\n        <\/div> <div class=\"faq-item__content\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\"><div class=\"faq-item__body\" itemprop=\"text\"><p>Check server access logs for POST requests to admin-ajax.php using the super_submit_form action. Also check for direct requests inside the Elementor forms upload directory. Unfamiliar .php files in either upload path are a strong indicator of compromise.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n<h3>Conclusion<\/h3>\n<p>The exploitation volume behind CVE-2026-14894 and CVE-2026-32475 confirms that patch delay carries real cost. Attackers scaled a working web shell against Super Forms within days of disclosure. They moved on Elementor Pro just as quickly. Waiting for a quiet week to patch is no longer a safe assumption for public-facing WordPress plugins.<\/p>\n<p>Site owners running either plugin should patch now, hunt for unfamiliar PHP files, and audit administrator accounts for unauthorized changes. Pairing that work with endpoint compliance for the people who manage these sites closes a real gap. Patching the plugin alone does not cover that gap.<\/p>\n<div class=\"signup_box\"><div class=\"signup_wrap_img\"><div class=\"signup-bg\" style=\"background-image:url(https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/Hexnode-MDM-free-trial.jpg?format=webp)\"><\/div><\/div><div class=\"signup_wrap\"><h5>Stay ahead of active WordPress exploits.  <\/h5><p>Get weekly threat intelligence briefs built for security teams. <\/p><a href=\"https:\/\/www.hexnode.com\/xdr\/signup\/\" class=\"hn-cta__blogs--signup-stripe\" target=\"_blank\"> SIGN UP NOW<\/a><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Wordfence has blocked over 440,000 exploit attempts against two actively exploited WordPress plugin vulnerabilities in&#8230;<\/p>\n","protected":false},"author":5,"featured_media":1429,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[15,21],"class_list":["post-1421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware","category-patch-management","product_category-extended-detection-and-response","tab_group-vulnerabilities"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-14894: Super Forms and Elementor Pro RCE Guide<\/title>\n<meta name=\"description\" content=\"CVE-2026-14894 and CVE-2026-32475 face active exploitation on WordPress. Learn the attack mechanics, patch versions, and IOC hunting steps.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-14894: Super Forms and Elementor Pro RCE Guide\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-14894 and CVE-2026-32475 face active exploitation on WordPress. Learn the attack mechanics, patch versions, and IOC hunting steps.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"Hexnode Threat Watch\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hexnode\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-07T08:52:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-08T05:37:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/09\/cve-2026-14894.jpeg?format=webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1340\" \/>\n\t<meta property=\"og:image:height\" content=\"700\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sophia Hart\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:site\" content=\"@thehexnode\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sophia Hart\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/\"},\"author\":{\"name\":\"Sophia Hart\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\"},\"headline\":\"CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack\",\"datePublished\":\"2026-09-07T08:52:22+00:00\",\"dateModified\":\"2026-09-08T05:37:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/\"},\"wordCount\":1242,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cve-2026-14894.jpeg?format=webp\",\"articleSection\":[\"Malware\",\"Patch Management\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/\",\"name\":\"CVE-2026-14894: Super Forms and Elementor Pro RCE Guide\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cve-2026-14894.jpeg?format=webp\",\"datePublished\":\"2026-09-07T08:52:22+00:00\",\"dateModified\":\"2026-09-08T05:37:31+00:00\",\"description\":\"CVE-2026-14894 and CVE-2026-32475 face active exploitation on WordPress. Learn the attack mechanics, patch versions, and IOC hunting steps.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cve-2026-14894.jpeg?format=webp\",\"contentUrl\":\"https:\\\/\\\/cdn.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/cve-2026-14894.jpeg?format=webp\",\"width\":1340,\"height\":700,\"caption\":\"cve 2026 14894\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#website\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"name\":\"Hexnode Threat Watch\",\"description\":\"Latest cyber threats, smarter enterprise response.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\"},\"alternateName\":\"Threat Watch\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#organization\",\"name\":\"Hexnode\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"contentUrl\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/hexnode-2.png?format=webp\",\"width\":100,\"height\":100,\"caption\":\"Hexnode\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Hexnode\\\/\",\"https:\\\/\\\/x.com\\\/thehexnode\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/hexnode\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/#\\\/schema\\\/person\\\/7303d7e90665b5fbccde155fa1c11430\",\"name\":\"Sophia Hart\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g\",\"caption\":\"Sophia Hart\"},\"description\":\"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.\",\"url\":\"https:\\\/\\\/www.hexnode.com\\\/threat-watch\\\/author\\\/sophia-hart\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-14894: Super Forms and Elementor Pro RCE Guide","description":"CVE-2026-14894 and CVE-2026-32475 face active exploitation on WordPress. Learn the attack mechanics, patch versions, and IOC hunting steps.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-14894: Super Forms and Elementor Pro RCE Guide","og_description":"CVE-2026-14894 and CVE-2026-32475 face active exploitation on WordPress. Learn the attack mechanics, patch versions, and IOC hunting steps.","og_url":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/","og_site_name":"Hexnode Threat Watch","article_publisher":"https:\/\/www.facebook.com\/Hexnode\/","article_published_time":"2026-09-07T08:52:22+00:00","article_modified_time":"2026-09-08T05:37:31+00:00","og_image":[{"width":1340,"height":700,"url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/09\/cve-2026-14894.jpeg?format=webp","type":"image\/jpeg"}],"author":"Sophia Hart","twitter_card":"summary_large_image","twitter_creator":"@thehexnode","twitter_site":"@thehexnode","twitter_misc":{"Written by":"Sophia Hart","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#article","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/"},"author":{"name":"Sophia Hart","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430"},"headline":"CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack","datePublished":"2026-09-07T08:52:22+00:00","dateModified":"2026-09-08T05:37:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/"},"wordCount":1242,"commentCount":0,"publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/09\/cve-2026-14894.jpeg?format=webp","articleSection":["Malware","Patch Management"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/","url":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/","name":"CVE-2026-14894: Super Forms and Elementor Pro RCE Guide","isPartOf":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#primaryimage"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/09\/cve-2026-14894.jpeg?format=webp","datePublished":"2026-09-07T08:52:22+00:00","dateModified":"2026-09-08T05:37:31+00:00","description":"CVE-2026-14894 and CVE-2026-32475 face active exploitation on WordPress. Learn the attack mechanics, patch versions, and IOC hunting steps.","breadcrumb":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#primaryimage","url":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/09\/cve-2026-14894.jpeg?format=webp","contentUrl":"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/09\/cve-2026-14894.jpeg?format=webp","width":1340,"height":700,"caption":"cve 2026 14894"},{"@type":"BreadcrumbList","@id":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-14894-super-forms-elementor-pro-rce-under-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hexnode.com\/threat-watch\/"},{"@type":"ListItem","position":2,"name":"CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack"}]},{"@type":"WebSite","@id":"https:\/\/www.hexnode.com\/threat-watch\/#website","url":"https:\/\/www.hexnode.com\/threat-watch\/","name":"Hexnode Threat Watch","description":"Latest cyber threats, smarter enterprise response.","publisher":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization"},"alternateName":"Threat Watch","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hexnode.com\/threat-watch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hexnode.com\/threat-watch\/#organization","name":"Hexnode","url":"https:\/\/www.hexnode.com\/threat-watch\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/","url":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","contentUrl":"https:\/\/www.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/hexnode-2.png?format=webp","width":100,"height":100,"caption":"Hexnode"},"image":{"@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hexnode\/","https:\/\/x.com\/thehexnode","https:\/\/www.linkedin.com\/company\/hexnode"]},{"@type":"Person","@id":"https:\/\/www.hexnode.com\/threat-watch\/#\/schema\/person\/7303d7e90665b5fbccde155fa1c11430","name":"Sophia Hart","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9f2fcf8cf2a94925b3769939d19f157c643407bd45ff69fd553f22903b961f3a?s=96&d=mm&r=g","caption":"Sophia Hart"},"description":"A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions\u2014without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable\u2014politely.","url":"https:\/\/www.hexnode.com\/threat-watch\/author\/sophia-hart\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/1421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/comments?post=1421"}],"version-history":[{"count":6,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/1421\/revisions"}],"predecessor-version":[{"id":1461,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/posts\/1421\/revisions\/1461"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media\/1429"}],"wp:attachment":[{"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/media?parent=1421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexnode.com\/threat-watch\/wp-json\/wp\/v2\/categories?post=1421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}