Researchers from Wordfence have identified significant security vulnerabilities in two popular WordPress plugins: Super Forms and Elementor Pro. These plugins are currently being targeted by threat actors, utilizing critical flaws to gain unauthorized access to affected websites. The focus keyword ‘WordPress security vulnerabilities’ highlights the severity of these issues.
Details of the Security Flaws
The vulnerabilities include CVE-2026-14894, with a CVSS score of 9.8, and CVE-2026-32475, both allowing unauthenticated attackers to upload potentially harmful files. These flaws could lead to remote code execution, threatening the integrity of WordPress sites using these plugins. Super Forms’ vulnerability was patched in version 6.3.314, while Elementor Pro’s was addressed in version 4.2.2.
An attacker could exploit these vulnerabilities to upload a PHP web shell, enabling actions like creating new admin accounts or exfiltrating site data. Notably, CVE-2026-32475’s details were disclosed by Patchstack last month, requiring a published Elementor page with a File Upload field for successful exploitation.
Current Exploit Attempts and Impact
Wordfence has already blocked over 250,000 and 190,000 attempts targeting CVE-2026-14894 and CVE-2026-32475, respectively. The attack on Super Forms involves an HTTP POST request to ‘/wp-admin/admin-ajax.php,’ with a Base64-encoded PHP payload disguised as an image file. This method has been traced back to several IP addresses.
For Elementor Pro, the exploit manipulates the File Upload field to bypass validation, placing the malicious PHP file in the ‘/wp-content/uploads/elementor/forms/’ directory. The attacks on this plugin began on August 19, 2026, with various IP addresses identified as sources.
Recommendations for WordPress Site Owners
WordPress administrators using these plugins are strongly advised to implement the available patches immediately. Additionally, it is crucial to scan for indicators of compromise and audit for any unexpected or recently modified PHP files. These proactive measures are essential to safeguarding websites from these active threats.
As cyber threats continue to evolve, maintaining updated security practices is vital. Ensuring plugins are current and monitoring site integrity can mitigate risks associated with vulnerabilities like those found in Super Forms and Elementor Pro.
