hacker-news · Crawled Sep 4, 2026
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
21 IoCs 1 CVEs
Read original article ↗
AI Summary
Threat actors are actively exploiting two critical remote code execution (RCE) vulnerabilities in WordPress plugins Super Forms and Elementor Pro. CVE-2026-14894 and CVE-2026-32475 allow unauthenticated attackers to upload arbitrary PHP files, enabling remote code execution via web shells. Exploitation attempts have exceeded 440,000, with attacks observed since July 14, 2026, peaking in August. Attackers upload PHP web shells such as 'Mushr00w_upl.php' and leverage them to execute commands, exfiltrate data, or take control of WordPress sites.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 21 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 103[.]168[.]147[.]235 | Details → |
| IP | 103[.]168[.]146[.]131 | Details → |
| IP | 103[.]154[.]152[.]178 | Details → |
| IP | 103[.]170[.]97[.]7 | Details → |
| IP | 182[.]10[.]130[.]51 | Details → |
| IP | 189[.]4[.]122[.]140 | Details → |
| IP | 129[.]227[.]46[.]143 | Details → |
| IP | 64[.]176[.]209[.]104 | Details → |
| IP | 103[.]164[.]182[.]122 | Details → |
| IP | 37[.]9[.]33[.]62 | Details → |
| IP | 2602:fa59:10:7a1::1 | Details → |
| IP | 185[.]196[.]220[.]85 | Details → |
| IP | 103[.]84[.]230[.]85 | Details → |
| IP | 103[.]90[.]148[.]202 | Details → |
| IP | 216[.]126[.]225[.]208 | Details → |
| IP | 167[.]254[.]240[.]75 | Details → |
| IP | 167[.]254[.]241[.]119 | Details → |
| IP | 114[.]10[.]17[.]253 | Details → |
| IP | 114[.]10[.]45[.]151 | Details → |
| IP | 2406:ef80:2:7d19::1 | Details → |
| Filename | Mushr00w_upl.php | Details → |