ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Super Forms”

12 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 41Malware 35Industry 24Data breach 17Phishing & fraud 16Policy & legal 15Threat actor 15Ransomware 14Exploit / PoC 12Research 11AI tools & infra 5AI industry 2AI research 2AI safety & security 2
SeverityAllcritical 52high 56medium 46low 49info 9

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker News · 12d agoExploit / PoC in the wildCVE-2026-14894CVE-2026-32475

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.

Wordfence disclosed on July 9, 2026 a critical unauthenticated arbitrary file upload vulnerability in the Super Forms WordPress plugin, which has roughly 13,000 active installations. Unauthenticated attackers can upload arbitrary files, including PHP backdoors, to achieve remote code execution. The vendor now reports that attackers are actively exploiting the flaw in the wild.

Wordfence · 13d agoExploit / PoC in the wild