# WordPress RCE Exploited via CVE-2026-14894 & CVE-2026-32475

> Attackers exploit critical RCE flaws in WordPress Super Forms (CVE-2026-14894) and Elementor Pro (CVE-2026-32475) to deploy web shells and seize sites.

- Published: 2026-09-04T12:22:02.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: WordPress, RCE, Web Shells, Super Forms, Elementor Pro
- CVEs: CVE-2026-14894 (CVSS 9.8), CVE-2026-32475 (CVSS 9.8)
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html
- Canonical: https://runtimerebel.com/blog/wordpress-rce-exploited-via-cve-2026-14894-cve-2026-32475

## Key points

- Immediate impact: Attackers are actively exploiting critical RCE flaws in WordPress plugins, enabling full site compromise via web shells.
- Affected systems: WordPress sites using Super Forms and Elementor Pro with an active Form widget containing a File Upload field.
- Remediation: Apply available patches immediately, scan for indicators of compromise, and audit for suspicious PHP files.

Threat actors are actively exploiting two critical remote code execution ([RCE](/glossary#rce)) vulnerabilities in popular WordPress plugins: Super Forms and Elementor Pro. These flaws, identified as [CVE-2026-14894](https://nvd.nist.gov/vuln/detail/CVE-2026-14894) and [CVE-2026-32475](https://nvd.nist.gov/vuln/detail/CVE-2026-32475), enable attackers to upload arbitrary files, typically PHP web shells, to compromised sites. This allows for subsequent execution of arbitrary code, potentially leading to the creation of administrator accounts, [data exfiltration](/glossary#data-exfiltration), or complete control over the WordPress installation.

According to findings from [Wordfence](https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html), over 440,000 [exploit](/glossary#exploit) attempts have been blocked, underscoring the widespread nature and severity of these ongoing campaigns. Defenders must prioritize patching and diligent monitoring to protect their WordPress assets.

## Technical Analysis of WordPress RCE Exploits

The exploitation of both CVEs hinges on arbitrary file upload vulnerabilities, which are particularly dangerous as they allow threat actors to introduce and execute malicious code directly on the server. Successful exploitation requires the target WordPress site to have at least one published Elementor page containing a Form widget configured with a File Upload field.

### [CVE](/glossary#cve)-2026-14894: Super Forms Exploitation Details

Attacks targeting the Super Forms plugin, tracked as [CVE-2026-14894](https://nvd.nist.gov/vuln/detail/CVE-2026-14894), commenced on July 14, 2026, and peaked with over 40,000 exploit requests on August 18, 2026. Wordfence reports blocking over 250,000 attempts against this specific [vulnerability](/glossary#vulnerability). The method of exploitation involves attackers issuing an HTTP POST request to `/wp-admin/admin-ajax.php`, utilizing the `super_submit_form` [endpoint](/glossary#endpoint). This request contains a file field with a Base64-encoded PHP [payload](/glossary#payload) and an attacker-controlled file name. The core of the attack payload often includes a web shell, such as `Mushr00w_upl.php`, disguised with a `data:image/gif;base64` content type prefix, despite being a PHP file.

Wordfence details that attackers submit the form's File Upload field as an array. The first element is empty, while the second carries the PHP payload with a `.php` file extension. This specific structure triggers a validation bypass within the plugin. Once uploaded, the malicious PHP file is placed in the `/wp-content/uploads/elementor/forms/` directory under a randomly generated filename but retains the attacker-supplied `.php` extension. From there, the attacker can directly request and execute the file to run arbitrary commands on the server.

### CVE-2026-32475: Elementor Pro Exploitation Details

Exploitation efforts for [CVE-2026-32475](https://nvd.nist.gov/vuln/detail/CVE-2026-32475) in Elementor Pro began shortly after, on August 19, 2026. Wordfence has blocked over 190,000 exploit attempts targeting this vulnerability. While the source details fewer specifics about the exact request structure for Elementor Pro, the underlying mechanism is also an arbitrary file upload that leverages a misconfiguration or flaw in file validation, allowing PHP web shells to be placed on the server.

## Actionable Recommendations and Mitigations

To protect against these actively exploited vulnerabilities, WordPress site owners using Super Forms and Elementor Pro must take immediate action.

*   **Apply Patches Immediately**: Update Super Forms and Elementor Pro to the latest versions provided by the developers. The source strongly recommends applying patches with immediate effect. These patches address the underlying arbitrary file upload vulnerabilities.
*   **Scan for Indicators of Compromise (IoCs)**: After patching, thoroughly scan your WordPress site for any signs of compromise. Look for unexpected or recently modified `.php` files, especially within the `/wp-content/uploads/elementor/forms/` directory. Identifying WordPress web shells in uploads directory is a critical step in post-compromise cleanup.
*   **Audit for Unexpected Files**: Beyond the `elementor/forms` directory, audit your entire file system for any unfamiliar `.php` files or other executable scripts that may have been uploaded. Threat actors often use web shells as a beachhead to upload additional persistent backdoors.
*   **Review Administrator Accounts**: Check for any newly created or modified administrator accounts that are not legitimate. Attackers frequently create new admin users to maintain access even after initial web shells are removed.
*   **Implement Web Application [Firewall](/glossary#firewall) ([WAF](/glossary#waf))**: A WAF can provide an additional layer of defense by blocking known malicious requests targeting these and similar vulnerabilities, even if a [patch](/glossary#patch) cannot be applied instantly. This helps to detect and block attempts to exploit the Elementor Pro arbitrary file upload vulnerability mitigation.

These critical vulnerabilities pose a significant risk to affected WordPress installations, making swift patching and thorough security audits essential.

**Related:** [CVE-2026-64638: WordPress Pre-Auth XSS Leads to PHP RCE](/blog/cve-2026-64638-wordpress-pre-auth-xss-leads-to-php-rce), [WordPress wp2shell RCE: Public Exploits Released for Core Flaws](/blog/wordpress-wp2shell-rce-public-exploits-released-for-core-flaws)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/wordpress-rce-exploited-via-cve-2026-14894-cve-2026-32475