Recent reports indicate a significant surge in exploitation attempts targeting two critical vulnerabilities in WordPress plugins, specifically Super Forms and Elementor Pro. According to data from Wordfence, these vulnerabilities have been actively exploited, leading to over 440,000 attempts.
Identified Vulnerabilities
The vulnerabilities are identified as CVE-2026-14894 and CVE-2026-32475. The first, CVE-2026-14894, has a CVSS score of 9.8 and involves a missing file type validation in the Super Forms plugin. This flaw allows unauthenticated attackers to upload any file type, including executable PHP files, which can lead to remote code execution. This vulnerability has been addressed in version 6.3.314 of the plugin.
The second vulnerability, CVE-2026-32475, also allows unauthenticated file uploads and has a CVSS score of 9.0/9.8. It affects Elementor Pro and has been patched in version 4.2.2. Both vulnerabilities enable attackers to upload malicious PHP files that can compromise the entire WordPress site.
Exploitation Details
Wordfence reports indicate that over 250,000 exploit attempts have targeted CVE-2026-14894, while approximately 190,000 attempts have been directed at CVE-2026-32475. The exploitation of CVE-2026-14894 involves sending an HTTP POST request to the /wp-admin/admin-ajax.php endpoint, using the super_submit_form action to upload a Base64-encoded PHP payload.
For CVE-2026-32475, attackers submit a form’s File Upload field in a specific structure that bypasses validation, allowing PHP files to be uploaded to the /wp-content/uploads/elementor/forms/ directory. These files can then be executed directly by the attacker.
Timeline and Recommendations
The malicious activity targeting these vulnerabilities began on July 14, 2026, for CVE-2026-14894, peaking at over 40,000 exploit requests on August 18, 2026. Exploitation efforts for CVE-2026-32475 started on August 19, 2026. WordPress site owners using the affected plugins are strongly advised to apply the necessary patches immediately, conduct scans for indicators of compromise, and audit for any unexpected or recently modified PHP files.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
