WORDFENCE reports that attackers are actively exploiting two critical WordPress plugin flaws to upload arbitrary PHP files and achieve remote code execution. The vulnerabilities are CVE-2026-14894 in the Super Forms Drag & Drop Form Builder (CVSS 9.8) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8). In practice, exploitation allows unauthenticated users to upload PHP payloads, write a web shell to the site, and then run arbitrary commands.
Wordfence notes that CVE-2026-32475 requires a target site to have an Elementor page containing a Form widget with a File Upload field for successful exploitation. Patches are available: Super Forms fix in version 6.3.314 and Elementor Pro fix in version 4.2.2.
Evidence from Wordfence shows widespread activity: over 250,000 exploit attempts for CVE-2026-14894 and around 190,000 for CVE-2026-32475 have been observed. The reports describe how attackers funnel PHP payloads through the plugin upload workflow, including specific endpoints such as admin-ajax[.]php for CVE-14894 and handling uploaded PHP files placed under /wp-content/uploads/elementor/forms/ for CVE-32475.
IP addresses linked to the activity are listed, and activity on CVE-14894 began circa 14 July 2026 with a peak around 18 August 2026. The practical response urged by Wordfence and The Hacker News is to apply patches immediately, scan for indicators of compromise, and audit for recently modified PHP files to identify and mitigate any footholds.