Update Super Forms and Elementor Pro to the latest patched versions immediately. Apply all WordPress security updates. Monitor logs for suspicious file uploads or admin account creation. Implement web application firewall rules to block unauthorized file uploads.
Quick answers
What is CVE-2026-14894?
Update Super Forms and Elementor Pro to the latest patched versions immediately. Apply all WordPress security updates. Monitor logs for suspicious file uploads or admin account creation. Implement web application firewall rules to block unauthorized file uploads.
How severe is CVE-2026-14894?
critical, CVSS 9.8
Is CVE-2026-14894 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-14894 be mitigated?
Update Super Forms and Elementor Pro to the latest patched versions immediately. Apply all WordPress security updates. Monitor logs for suspicious file uploads or admin account creation. Implement web application firewall rules to block unauthorized file uploads.
CVSS
9.8
Vendor
Automattic
Published
Sep 30, 2026 · 08:43
Patch
Unknown / not confirmed
Affected products
Super Forms, Elementor Pro
Mitigation
Update Super Forms and Elementor Pro to the latest patched versions immediately. Apply all WordPress security updates. Monitor logs for suspicious file uploads or admin account creation. Implement web application firewall rules to block unauthorized file uploads.
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities allow unauthenticated attackers to upload arbitrary file types and create admin users, with over 440,000 exploit attempts detected. Affected sites face potential remote code execution and full compromise.
