Over 440,000 Exploit Attempts Target Critical WordPress Plugin Vulnerabilities
Threat actors are actively exploiting two critical remote code execution vulnerabilities in the popular WordPress plugins Super Forms and Elementor Pro, with hundreds of thousands of exploit attempts detected.
Cybercriminals are actively exploiting two critical security flaws in widely-used WordPress plugins, Super Forms and Elementor Pro, leading to widespread attempts to compromise websites. Security researchers at Wordfence have identified and blocked over 440,000 exploit attempts targeting these vulnerabilities in recent weeks.
The first vulnerability, tracked as CVE-2026-14894 with a CVSS score of 9.8, resides in the Super Forms – Drag & Drop Form Builder plugin. This flaw allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, by bypassing file type validation. The vulnerability has been fixed in Super Forms version 6.3.314.
Exploitation of CVE-2026-14894 involves sending an HTTP POST request to the admin-ajax.php endpoint with the super_submit_form action. Attackers embed a Base64-encoded PHP payload within a file field, disguised as a legitimate image file. This payload, when uploaded, functions as a web shell, enabling attackers to execute arbitrary code on the compromised server.
Wordfence reported blocking more than 250,000 exploit attempts against this Super Forms vulnerability. The malicious activity was observed to begin on July 14, 2026, and peaked on August 18, 2026, with over 40,000 exploit requests in a single day. Attackers have been observed originating from various IP addresses across different regions.
The second critical vulnerability, CVE-2026-32475 (CVSS 9.0/9.8), affects Elementor Pro, a popular page builder plugin. This flaw also permits unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to remote code execution. This vulnerability was addressed in Elementor Pro version 4.2.2.
Exploitation of CVE-2026-32475 requires the target site to have a published Elementor page with a Form widget that includes a File Upload field. Attackers craft a specific form submission that bypasses validation, allowing them to upload a PHP payload. This payload is then saved in the /wp-content/uploads/elementor/forms/ directory with a random filename and the .php extension, enabling direct execution of commands on the server.
Wordfence has blocked over 190,000 exploit attempts targeting the Elementor Pro vulnerability. Exploitation for this flaw began on August 19, 2026, and has also originated from a range of IP addresses, including both IPv4 and IPv6 sources.
Successful exploitation of either vulnerability can grant attackers full control over a WordPress site. This can be used to create administrator accounts, steal sensitive data, deface the website, or use the compromised server for further malicious activities. Website owners are strongly advised to update both Super Forms and Elementor Pro to their latest patched versions immediately and to conduct security audits for any signs of compromise.