Threat actors have launched a coordinated, high-volume offensive against WordPress sites, targeting two critical vulnerabilities in popular plugins. In a campaign that has already generated over 440,000 exploit attempts, attackers are actively weaponizing flaws in Super Forms — Drag & Drop Form Builder and Elementor Pro to achieve unauthenticated remote code execution. The scale of the assault, documented by Wordfence, underscores the persistent danger posed by arbitrary file upload vulnerabilities and the urgent need for site owners to apply patches immediately.
Two Critical Vulnerabilities Under Active Exploitation
The two flaws at the heart of this campaign are CVE-2026-14894 and CVE-2026-32475. Both carry severe CVSS scores and permit unauthenticated attackers to upload executable PHP files, effectively granting complete control over the affected WordPress installation. The vulnerabilities are distinct in their root causes but converge on the same catastrophic outcome: remote code execution.
CVE-2026-14894 (CVSS 9.8) resides in the Super Forms plugin — a drag-and-drop form builder used by thousands of sites. The issue is a missing file type validation in the file upload mechanism. An attacker can submit a crafted HTTP POST request to the super_submit_formcodecodecodecode action via admin-ajax.phpcodecodecodecode, including a file field that contains a Base64-encoded PHP payload. The plugin fails to verify the file’s MIME type or extension, allowing the upload of a PHP web shell. The vulnerability was addressed in version 6.3.314 of Super Forms.
CVE-2026-32475 (CVSS 9.0, with some assessments at 9.8) affects Elementor Pro, the premium version of the widely used page builder. The vulnerability lies in the Form widget’s file upload field. By submitting the file upload data as an array where the first element is empty and the second carries a PHP payload with a .phpcodecodecodecode extension, attackers can bypass validation checks. Successful exploitation requires the target site to have at least one published Elementor page containing a Form widget with a File Upload field. The fix was released in Elementor Pro version 4.2.2.
What Makes Arbitrary File Upload Vulnerabilities So Dangerous?
Arbitrary file upload flaws are among the most feared WordPress vulnerabilities because they bypass multiple layers of security. An attacker who can upload a file with a server-executable extension — such as .phpcodecodecodecode — can write a web shell directly to the web root or a writable directory. Once the shell is in place, the attacker can execute arbitrary system commands, create new administrator accounts, exfiltrate the database, install persistent backdoors, or pivot to other applications on the same server. In both cases, the uploaded file is accessible via a direct HTTP request, giving the attacker a reliable foothold.
For CVE-2026-14894, the uploaded shell is written to the WordPress uploads directory or a plugin-specific directory, depending on the server configuration. For CVE-2026-32475, the file lands in /wp-content/uploads/elementor/forms/codecodecodecode under a randomly generated filename but with the attacker-supplied .phpcodecodecodecode extension.
CVE-2026-14894: Super Forms Exploit in Detail
Attack Vector and Payload Structure
Wordfence observed attackers sending HTTP POST requests to /wp-admin/admin-ajax.phpcodecodecodecode with the following parameters: action=super_submit_form&form_id=2&sf_nonce=[nonce]&data=[encoded JSON]codecodecodecode. The JSON data contains a field named sf_upload_fieldcodecodecodecode that is an object with the file details. The critical part is the datauristringcodecodecodecode attribute, which is a Base64-encoded payload prefixed with data:image/gif;base64,codecodecodecode. This prefix is intended to disguise the payload as a GIF image, but the actual content is a PHP file-uploader web shell dubbed Mushr00w_upl.phpcodecodecodecode.
When the server processes the upload, it strips the data URI prefix and writes the decoded PHP code to a file using the name specified in the valuecodecodecodecode field — in this case, Mushr00w_upl.phpcodecodecodecode. That file is a simple one-trick pony: it provides a form-based upload interface that allows the attacker to upload any additional files (such as a full-featured shell or a backdoor) to the server. The initial shell acts as a conduit, enabling further compromise.
Timeline and Attack Scale
Malicious activity targeting CVE-2026-14894 began on July 14, 2026. Attack volume grew steadily, peaking on August 18, 2026, with more than 40,000 exploit requests in a single day. Wordfence has blocked over 250,000 attempts in total. The attacks originated from a diverse set of IP addresses, many of which are associated with hosting providers and VPS services commonly abused by threat actors:
- 103.168.147.235
- 103.168.146.131
- 103.154.152.178
- 103.170.97.7
- 182.10.130.51
- 189.4.122.140
- 129.227.46.143
- 64.176.209.104
- 103.164.182.122
- 37.9.33.62
The geographic distribution spans multiple continents, suggesting a distributed campaign rather than a single attacker.
CVE-2026-32475: Elementor Pro Exploit Details
Validation Bypass Technique
The Elementor Pro vulnerability is more subtle in its exploitation. The Form widget’s file upload validation logic accepts an array of files for the upload field. An attacker can submit the form data such that the file upload field is an array: the first element is empty (an empty file name or null), and the second element contains a PHP payload with a .phpcodecodecodecode file name. The validation code only checks the first element and, finding it empty, fails to properly reject the second element. This bypass allows the PHP file to pass through and be written to the server.
Once written, the uploaded file is saved in /wp-content/uploads/elementor/forms/codecodecodecode with a randomly generated filename (e.g., abc123.phpcodecodecodecode), and the attacker can request it directly via HTTP to execute commands. The directory is typically web-accessible, making the shell immediately available.
Attack Onset and Observed IPs
Exploitation of CVE-2026-32475 began on August 19, 2026, one day after the Super Forms campaign peaked. Wordfence has blocked over 190,000 exploit attempts targeting this flaw. The attacks used the following IP addresses, some overlapping with those seen in the Super Forms campaign but also including IPv6 addresses:
- 2602:fa59:10:7a1::1
- 185.196.220.85
- 103.84.230.85
- 103.90.148.202
- 216.126.225.208
- 167.254.240.75
- 167.254.241.119
- 114.10.17.253
- 114.10.45.151
- 2406:ef80:2:7d19::1
It is noteworthy that Patchstack disclosed details of the Elementor Pro flaw in late August 2026, a disclosure that likely accelerated the exploitation. The coincidence of the two campaigns occurring in close temporal proximity suggests that threat actors are systematically scanning for these specific plugins and automating the exploitation process.
Contextualizing the Threat: Why WordPress Admins Should Act Now
The combined total of more than 440,000 exploit attempts is staggering but not unprecedented for high-profile WordPress vulnerabilities. However, the simultaneous exploitation of two unrelated plugins with similar impact indicates a deliberate focus on file upload flaws, which are notoriously hard to defend against without proper input validation. Both Super Forms and Elementor Pro have large user bases — Elementor alone powers millions of sites — making the attack surface enormous.
What makes these attacks particularly insidious is the use of obfuscated payloads (Base64 with GIF prefix) and the multi-stage approach (uploading a small uploader shell to then upload a second, more capable payload). This technique allows attackers to evade signature-based detections at the initial request level and then expand their foothold within the site.
Site owners who have not updated to the patched versions — Super Forms 6.3.314 and Elementor Pro 4.2.2 — are vulnerable to complete compromise. Even if a site is patched, earlier successful exploitation may have left backdoors. A thorough audit is necessary.
What Site Owners Should Do Right Now
Immediate Actions
- Update Super Forms to version 6.3.314 or later.
- Update Elementor Pro to version 4.2.2 or later.
- Scan the
/wp-content/uploads/codecodecodecode directory for unknown PHP files, especially those with names likeMushr00w_upl.phpcodecodecodecode or any recently created.phpcodecodecodecode files in subdirectories. - Check
/wp-content/uploads/elementor/forms/codecodecodecode for any unexpected PHP files. Delete any that are not legitimate. - Review WordPress user accounts for any new administrators or suspicious users, especially those created around July–September 2026.
Long-Term Security Practices
- Implement a Web Application Firewall (WAF) that can block malicious file upload patterns. Many WAFs can detect data URI payloads in file fields.
- Disable file upload functionality on forms that do not require it.
- Regularly audit plugin and theme versions. Subscribe to security advisory feeds from credible sources.
- Use file integrity monitoring tools to alert on new executable files in web-accessible directories.
The vulnerabilities exploited here are not zero-days — they have been patched for weeks. The ongoing attacks primarily target unpatched sites. Delaying the update is no longer a risk tolerance decision; it is an acceptance of compromise.
Given the volume of exploit attempts already blocked, many site owners may never know they were targeted. But the attackers are persistent. The IP addresses listed above are just a sample; new nodes will certainly emerge. The best defense remains a proactive patching cadence and a hardened WordPress environment.
