Executive Summary
Two critical vulnerabilities, CVE-2026-14894 in Super Forms and CVE-2026-32475 in Elementor Pro, are being targeted in a large-scale exploitation campaign. Wordfence has reported blocking over 440,000 combined exploit attempts since mid-2026. These flaws allow unauthenticated attackers to bypass file validation and upload executable PHP scripts, leading to complete site takeover.
The attacks frequently involve the deployment of a specific web shell branded as 'Mushr00w Uploader'. This activity coincides with the broader 'StopAndProtect' campaign, which repurposes compromised WordPress installations for malware delivery and C2 infrastructure. The high volume of automated attacks suggests a significant threat to any site using vulnerable versions of these widely deployed plugins.
Immediate patching is required for Super Forms (v6.3.314+) and Elementor Pro (v4.2.2+). Organizations should also audit their WordPress instances for indicators of compromise, specifically in the uploads directories.
Key Details
Threat Name
WordPress Plugin RCE Exploitation
Affects
Super Forms – Drag & Drop Form Builder (before 6.3.314), Elementor Pro (before 4.2.2), Elementor Pro <= 4.2.1, Elementor Website Builder Pro, Super Forms – Drag & Drop Form Builder (WordPress plugin), Joomla content editor extension, Elementor Pro versions prior to 4.2.2, WordPress core versions 4.7 to 7.0
Adversary
Mushr00w
Malware/Tools
Mushr00w_upl.php, Mushr00w Uploader, StopAndProtect