Cybersecurity firm **Wordfence** has issued an urgent warning regarding active exploitation campaigns targeting critical vulnerabilities in two widely used **WordPress** plugins: **Super Forms – Drag & Drop Form Builder** and **Elementor Pro**. These security flaws enable unauthenticated attackers to upload arbitrary files, including executable PHP web shells, posing a significant risk to affected websites.  ### The Vulnerabilities at a Glance The two critical vulnerabilities under active exploitation are: * **CVE-2026-14894** (CVSS score: 9.8): A missing file type validation vulnerability in **Super Forms – Drag & Drop Form Builder**. This allows unauthenticated attackers to upload any file type, including executable PHP files, leading to remote code execution. The issue has been fixed in version 6.3.314. * **CVE-2026-32475** (CVSS score: 9.0/9.8): A similar arbitrary file upload vulnerability in **Elementor Pro**. This flaw also permits unauthenticated attackers to upload executable PHP files, resulting in remote code execution. A patch is available in version 4.2.2. These types of arbitrary file upload vulnerabilities are particularly dangerous as they can be leveraged to write PHP web shells to a site. This grants attackers the ability to execute arbitrary code, create administrator accounts, exfiltrate sensitive data, or completely seize control of the **WordPress** site. It's important to note that details about **CVE-2026-32475** were previously disclosed by **Patchstack**. Successful exploitation of this vulnerability requires the target site to have at least one published **Elementor** page containing a Form widget with a File Upload field. **Wordfence** reports blocking over 250,000 exploit attempts targeting **CVE-2026-14894** and more than 190,000 attempts against **CVE-2026-32475** in recent weeks. ### Exploitation Against CVE-2026-14894 Attacks exploiting **CVE-2026-14894** involve threat actors issuing an HTTP POST request to `/wp-admin/admin-ajax.php` using the `super_submit_form` endpoint. This request contains a file field with a Base64-encoded PHP payload and an attacker-controlled filename. For example, the payload might look like this:  Despite the `data:image/gif;base64` content type prefix, the uploaded file is a PHP web shell named `Mushr00w_upl.php`. This shell then serves as a backdoor for attackers to upload additional malicious payloads. **Wordfence** identified that this malicious activity began on July 14, 2026, peaking with over 40,000 exploit requests on August 18, 2026. Attacks have originated from various IP addresses, including: * 103.168.147.235 * 103.168.146.131 * 103.154.152.178 * 103.170.97.7 * 182.10.130.51 * 189.4.122.140 * 129.227.46.143 * 64.176.209.104 * 103.164.182.122 * 37.9.33.62 ### Exploitation Against CVE-2026-32475 For **CVE-2026-32475**, the exploitation method involves the attacker submitting the form's File Upload field as an array. The first element of this array is empty, while the second carries a PHP payload with a `.php` file extension. This specific structure triggers the validation bypass within the **Elementor Pro** plugin. Once uploaded, the malicious PHP file is placed in the `/wp-content/uploads/elementor/forms/` directory under a randomly generated filename, retaining the attacker-supplied `.php` extension. Attackers can then directly request this file to execute arbitrary commands on the server. Exploitation efforts for **CVE-2026-32475** began on August 19, 2026, with attacks observed from IP addresses such as: * 2602:fa59:10:7a1::1 * 185.196.220.85 * 103.84.230.85 * 103.90.148.202 * 216.126.225.208 * 167.254.240.75 * 167.254.241.119 * 114.10.17.253 * 114.10.45.151 * 2406:ef80:2:7d19::1 ### Immediate Action Required **WordPress** site owners utilizing either the **Super Forms** or **Elementor Pro** plugins are strongly advised to apply the available patches immediately. Furthermore, it is crucial to scan their sites for any indicators of compromise and audit for unexpected or recently modified `.php` files that could indicate a successful breach.