CVE-2026-14894: Super Forms Arbitrary File Upload Under Active Exploitation — 440,000+ Attack Attempts Target WordPress Sites

Wordfence has disclosed an active, high-volume exploitation campaign targeting two critical remote code execution flaws in widely deployed WordPress plugins: Super Forms – Drag & Drop Form Builder and Elementor Pro. As of this writing, Wordfence's firewall telemetry shows over 440,000 blocked exploitation attempts, which tells us two things: weaponization is trivial, and automated scanners are sweeping the internet for vulnerable sites at scale.

The headline vulnerability, CVE-2026-14894 (CVSS 9.8 — Critical), is a missing file type validation flaw in Super Forms that permits unauthenticated attackers to upload files of any type — including PHP webshells — leading directly to remote code execution on the underlying web server. A companion flaw in Elementor Pro is being exploited in the same campaign window, giving attackers two distinct paths to full site compromise.

If your organization operates any WordPress property with these plugins installed — including dormant or staging sites — assume you are being scanned right now. This post breaks down the technical details, gives your SOC concrete detection content, and walks through remediation and hardening.

Technical Analysis

Affected Products

Both plugins are among the most popular components in the WordPress ecosystem. Elementor Pro alone powers millions of sites, and Super Forms is a common form-builder choice for marketing, e-commerce, and membership sites — exactly the sites that hold customer PII and payment-adjacent data.

CVE-2026-14894 — How the Attack Works

From a defender's perspective, the attack chain is depressingly simple:

1. Reconnaissance: Attackers enumerate sites running Super Forms by fingerprinting plugin assets (e.g., requests to /wp-content/plugins/super-forms/ paths or known form endpoints).
2. Weaponization: The form submission handler accepts file uploads but fails to validate the uploaded file's type/extension/MIME type before writing it to a web-accessible directory.
3. Exploitation: An unauthenticated attacker submits a crafted multipart POST request to the vulnerable upload handler with a PHP payload (a webshell such as a generic shell.php, upload.php, or an obfuscated one-liner). Because there is no server-side allow-list enforcement, the file is written to disk — typically under wp-content/uploads/ or a plugin-specific subdirectory.
4. Execution: The attacker issues a direct HTTP GET to the uploaded file's URL. The web server interprets it as PHP, and the attacker now has code execution with the privileges of the web server account (commonly www-data, apache, or nginx).
5. Post-exploitation (observed pattern in similar campaigns): Webshell staging, credential harvesting from wp-config.php (database creds), lateral movement into the hosting account, SEO poisoning/malvertising injection, and in many cases follow-on malware loaders.

No authentication, no user interaction, no special conditions. A CVSS 9.8 is fully warranted — this is network-reachable, low-complexity, and yields complete impact on confidentiality, integrity, and availability of the site.

Exploitation Status

• Confirmed active exploitation: Wordfence reports 440,000+ blocked exploit attempts against these flaws — this is not theoretical or PoC-only.
• Mass scanning: Volume at this level indicates automated exploit tooling has been integrated into botnet and scanner frameworks. Any internet-exposed vulnerable instance will be found.
• KEV status: Defenders should monitor the CISA Known Exploited Vulnerabilities catalog for inclusion; given the observed volume, KEV listing is a realistic near-term outcome and would impose binding remediation deadlines on federal agencies and strong guidance for everyone else.

The dual-plugin campaign (Super Forms + Elementor Pro in parallel) suggests threat actors are opportunistically maximizing coverage across the WordPress install base while vulnerable versions remain in the field.

Detection & Response

Detection for this campaign centers on three observable behaviors: (1) suspicious uploads reaching plugin endpoints, (2) PHP files appearing in upload directories, and (3) the PHP interpreter spawning shell commands — the classic webshell signature. These are the highest-fidelity, lowest-noise signals for this attack class.

Sigma Rules

---
title: PHP Interpreter Spawning Shell — Webshell Indicator
description: Detects the PHP interpreter or web server worker spawning system shells, a hallmark of webshell execution following arbitrary file upload exploitation such as CVE-2026-14894 (Super Forms).
status: experimental
id: 8c1f4a2e-3b7d-4e91-a5c6-2d8f9b0e1a34
author: Security Arsenal
date: 2026/09/15
references:
  - https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html
  - https://attack.mitre.org/techniques/T1505/003/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php'
      - '/php8.1-fpm'
      - '/php8.2-fpm'
      - '/php8.3-fpm'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/whoami'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate plugin update or maintenance scripts invoked by the web application
  - Some backup plugins shelling out to system utilities
level: high
---
title: Webshell File Created in WordPress Uploads Directory
description: Detects creation of PHP files under wp-content/uploads and plugin upload subdirectories, consistent with post-exploitation staging after CVE-2026-14894 arbitrary file upload against Super Forms or Elementor Pro.
status: experimental
id: 3f9e2b71-6c4a-4d28-b9e0-7a1c5d3f8e62
author: Security Arsenal
date: 2026/09/15
references:
  - https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html
  - https://attack.mitre.org/techniques/T1505/003/
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/uploads/superforms/'
      - '/wp-content/uploads/elementor/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.php8'
      - '.phtml'
      - '.phar'
      - '.inc'
  condition: selection_path and selection_ext
falsepositives:
  - Rare; legitimate plugins occasionally write PHP index files (index.php) for directory listing protection — tune by filename
level: high
---
title: Suspicious HTTP POST to WordPress Plugin Upload Endpoint
description: Detects POST requests to Super Forms AJAX/file upload handlers consistent with CVE-2026-14894 exploitation attempts observed by Wordfence (440,000+ blocked attempts).
status: experimental
id: b7d41c96-2e58-4f3a-9c1b-8e6a0d4f7b15
author: Security Arsenal
date: 2026/09/15
references:
  - https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html
  - https://attack.mitre.org/techniques/T1190/
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-content/plugins/super-forms/'
      - '/wp-json/super-forms/'
  selection_payload:
    cs-uri-query|contains:
      - 'action=super_'
      - 'file_upload'
      - 'upload'
  condition: selection_method and (selection_uri or selection_payload)
falsepositives:
  - Legitimate form submissions with file attachments — correlate with source IP reputation and whether the request is followed by GET requests to newly created files under uploads
level: medium

Analyst note: The third rule is intentionally tuned to medium — form endpoints receive legitimate POSTs constantly. Its real value is in correlation: a POST to the upload handler followed within minutes by a GET to a .php file under /wp-content/uploads/ from the same source IP is a near-certain compromise. Build that sequence logic into your SIEM correlation layer.

KQL — Microsoft Sentinel / Defender

If you ingest web server access logs (via CEF/Syslog from nginx/Apache, or an Azure WAF/front-door), this query hunts the exploitation-and-execution sequence:

// Hunt for CVE-2026-14894 exploitation sequence: upload POST followed by webshell access
let UploadWindow = 30m;
let UploadAttempts = Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("/wp-admin/admin-ajax.php", "/wp-content/plugins/super-forms/", "super_forms_file_upload")
| where SyslogMessage has "POST"
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| summarize UploadCount = count() by SourceIP, bin(TimeGenerated, 5m);
let ShellAccess = Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_all ("/wp-content/uploads/", ".php")
| where SyslogMessage has "GET"
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| extend ShellPath = extract(@"GET (/[^\s]*\.php)", 1, SyslogMessage)
| summarize ShellHits = count(), FirstShell = min(TimeGenerated), Paths = make_set(ShellPath) by SourceIP;
ShellAccess
| join kind=inner UploadAttempts on SourceIP
| where FirstShell between (TimeGenerated .. TimeGenerated + UploadWindow)
| project SourceIP, UploadCount, ShellHits, FirstShell, Paths
| order by ShellHits desc;

For environments forwarding web server process telemetry via the Defender for Endpoint Linux agent, hunt for the webshell execution behavior directly:

// PHP/web server processes spawning shells or download tools — webshell behavior
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName has_any ("php-fpm", "php", "apache2", "httpd", "nginx")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3", "perl")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc;

Velociraptor VQL

For rapid fleet-wide triage of WordPress hosts, hunt for executable files planted in upload directories — the ground-truth artifact of a successful upload exploit:

-- Hunt for recently created PHP/executable files in WordPress upload directories
-- Targets webshell staging from CVE-2026-14894 and similar upload flaws
LET uploads_glob = '/var/www/**/wp-content/uploads/**/*.{php,php3,php5,php7,phtml,phar,inc}'

SELECT FullPath AS WebshellPath,
       Size AS FileSize,
       Mtime AS ModifiedTime,
       Btime AS CreatedTime,
       read_file(filename=FullPath, length=512) AS FileHeader
FROM glob(globs=uploads_glob)
WHERE Mtime > ago('72h')
ORDER BY ModifiedTime DESC

Review FileHeader for classic webshell markers: eval(, base64_decode(, shell_exec(, passthru(, $_REQUEST[, $_POST[ combined with execution functions, or WSO/c99/r57 shell fingerprints. Any PHP file in an uploads directory created in the last 72 hours on a host that ran a vulnerable plugin version should be treated as hostile until proven otherwise.

Remediation / Verification Script

Run this on your WordPress hosts (adjust WP_ROOT for your layout) to check plugin exposure, quarantine suspicious uploads, and block PHP execution in upload directories:

#!/bin/bash
# CVE-2026-14894 exposure check and emergency hardening — Super Forms / Elementor Pro
# Run as root or via sudo on each WordPress host.

WP_ROOT="/var/www/html"
QUAR="/root/quarantine_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$QUAR"

echo "=== [1] Installed plugin versions ==="
if command -v wp-cli &>/dev/null; then
  sudo -u www-data wp plugin list --path="$WP_ROOT" --format=table 2>/dev/null | grep -Ei 'super-forms|elementor' || echo "Neither plugin found via wp-cli"
else
  grep -ri "Version:" "$WP_ROOT/wp-content/plugins/super-forms/super-forms.php" 2>/dev/null
  grep -ri "Version:" "$WP_ROOT/wp-content/plugins/elementor-pro/elementor-pro.php" 2>/dev/null
fi

echo "=== [2] Scanning uploads directories for PHP/executable files (last 14 days) ==="
find "$WP_ROOT/wp-content/uploads" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.inc' \) -mtime -14 -print0 2>/dev/null | while IFS= read -r -d '' f; do
  echo "SUSPICIOUS: $f"
  cp --parents "$f" "$QUAR/" 2>/dev/null
  chmod 000 "$f"
done

echo "=== [3] Blocking PHP execution in uploads (Apache .htaccess) ==="
cat > "$WP_ROOT/wp-content/uploads/.htaccess" <<'EOF'
# Deny PHP execution in uploads — Security Arsenal hardening
<FilesMatch "\.(php|php[0-9]|phtml|phar|inc)$">
  Require all denied
</FilesMatch>
php_flag engine off
EOF
chmod 644 "$WP_ROOT/wp-content/uploads/.htaccess"

echo "=== [4] nginx equivalent (add to server block manually if running nginx) ==="
echo '  location ~* /wp-content/uploads/.*\.(php|phtml|phar|inc)$ { deny all; }'

echo "=== [5] Review web logs for exploit attempts against Super Forms endpoints ==="
grep -hE 'POST.*(admin-ajax\.php|super-forms)' /var/log/apache2/access.log /var/log/nginx/access.log 2>/dev/null | tail -50 > "$QUAR/suspect_posts.txt"
wc -l "$QUAR/suspect_posts.txt"

echo "=== DONE. Quarantine (if any) at: $QUAR ==="
echo "NEXT: Update both plugins to the latest patched releases via WP admin or wp-cli, then re-scan."

Remediation

Immediate actions (today):

1. Patch both plugins to the latest vendor releases. Update Super Forms – Drag & Drop Form Builder and Elementor Pro to the current fixed versions via the WordPress admin dashboard or wp plugin update. Do not rely on auto-update lag — force the update and verify the running version on every site, including staging and development environments, which are frequently exploited precisely because they're forgotten.
2. Audit for compromise before assuming patching saved you. With 440,000+ exploit attempts in flight, patching a site that was already shelled just locks the attacker's backdoor in place. Run the VQL hunt and Bash audit above. Check wp-content/uploads/ and plugin subdirectories for unexpected PHP files, review administrator accounts for unauthorized additions, and inspect wp-config.php and wp-content/mu-plugins/ for tampering.
3. Block PHP execution in upload directories at the web server layer (script above covers Apache and nginx patterns). This is a defense-in-depth control that neuters the entire class of upload-to-RCE attacks even when validation fails.
4. Deploy or verify WAF coverage. Wordfence and comparable WAFs are blocking these attempts — confirm your rule set is current and the plugin is not running in "learning mode" on production sites.

If compromise is confirmed:

• Isolate the host, preserve disk and web logs for forensics, and rotate all credentials the web server could reach: database credentials in wp-config.php, WordPress admin/salts (AUTH_KEY, SECURE_AUTH_KEY, etc.), API keys stored in plugin settings, and any service accounts.
• Rebuild from a known-clean backup where feasible; webshells routinely install redundant persistence (rogue admin users, modified theme files, cron jobs).
• File an incident per your IR plan and assess notification obligations if customer data resided on the site.

Strategic controls:

• Enforce a WordPress plugin inventory and update SLA — critical plugin CVEs should patch within 24-72 hours, full stop.
• Remove plugins that are installed but not in active use; disabled plugins are still exploitable.
• Monitor the CISA KEV catalog and Wordfence's advisory feed for updates on both flaws, including fixed version specifics and any KEV-mandated deadlines.
• Segment WordPress hosting from internal networks — a compromised marketing site should never become a pivot point into corporate infrastructure.

The volume here — 440,000 attempts and climbing — means this campaign is industrialized. Patch fast, but hunt first.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub