Attackers Mass-Exploit Super Forms and Elementor Pro WordPress File-Upload RCE Flaws (440,000+ Attempts); WordPress.org Adds AI-Driven Security Review of Plugin Releases
Wordfence/Defiant has blocked more than 440,000 exploit attempts against two critical unauthenticated arbitrary file upload RCE flaws in WordPress plugins: CVE-2026-14894 in Super Forms (CVSS 9.8, 250,000+ attempts) and CVE-2026-32475 in Elementor Pro…
Wordfence (Defiant) has blocked more than 440,000 exploit attempts across two critical unauthenticated arbitrary file upload RCE flaws in WordPress plugins: CVE-2026-14894 in Super Forms (over 250,000 blocked attempts) and CVE-2026-32475 in Elementor Pro (over 190,000 blocked attempts). The Super Forms flaw, disclosed on July 9, 2026, stems from missing file type validation, is rated CVSS 9.8, affects the plugin's roughly 13,000 active installations, and was fixed in Super Forms 6.3.314; exploitation began July 14, 2026 and peaked above 40,000 requests on August 18. The Elementor Pro flaw is an unauthenticated arbitrary file upload in form submission handling caused by a validation-loop bug (The Hacker News describes it as an upload bypass); it affects all versions up to 4.2.1 and was patched in version 4.2.2 released August 19, 2026, with exploitation beginning immediately after the fix shipped (August 19 per The Hacker News). Successful Elementor Pro exploitation additionally requires a published page containing a Form widget with a File Upload field. Sources disagree on the CVSS score for CVE-2026-32475: The Hacker News cites 9.0/9.8 while SecurityWeek cites 9.8. Successful attacks write attacker-controlled PHP files to /wp-content/uploads/elementor/forms/, enabling remote code execution and full site compromise; across both flaws, attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Roughly two-thirds of Elementor Pro's 10 million installations remained vulnerable as of September 4, 2026. Defiant urges administrators to patch, scan for indicators of compromise, audit unexpected .php files (checking /wp-content/uploads/elementor/forms/), and review requests to /wp-admin/admin-ajax.php. SOCRadar separately reported the Elementor Pro Forms module flaw as actively exploited without providing a CVE identifier; other reports identify it as CVE-2026-32475. In related supply-chain news, since June 5, 2026 every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score, and releases above the risk threshold are blocked automatically from the update API until issues are resolved. The change followed a July 28, 2026 incident in which a backdoor was pushed into a release of a plugin with roughly 20,000 active installations; the release was…
- Wordfence/Defiant blocked 440,000+ exploit attempts combined: over 250,000 against CVE-2026-14894 (Super Forms) and over 190,000 against CVE-2026-32475 (Elementor Pro).
- CVE-2026-14894: unauthenticated arbitrary file upload in the Super Forms plugin (CVSS 9.8, caused by missing file type validation); ~13,000 active installations; disclosed July 9, 2026; fixed in Super Forms 6.3.314; exploitation began July…
- CVE-2026-32475: unauthenticated arbitrary file upload in Elementor Pro form submission handling caused by a validation-loop bug (The Hacker News describes it as an upload bypass); affects all versions up to 4.2.1; patched in Elementor Pro…
- CVSS disagreement for CVE-2026-32475: The Hacker News cites 9.0/9.8 while SecurityWeek cites 9.8.
- Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field and writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/, enabling RCE and full site compromise;…
- Attackers deploy Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites.
- Roughly two-thirds of Elementor Pro's 10 million installations remained vulnerable as of September 4, 2026.
- SOCRadar reported the Elementor Pro Forms module flaw as actively exploited but provided no CVE identifier; other reports identify it as CVE-2026-32475.
Coverage timelineoldest first · each row is one article
- · 13d agoAttackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Wordfence· 58
Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-14894 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the sub The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests. NVD description · AI analysis pending | 9.8 | 5% |
| — | ||
| CVE-2026-32475 | Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild. Do: Update Elementor Pro to the latest patched release (any version after 4.2.1 — the data does not name a fixed build, so apply the newest available update). Until then, use WAF rules to block unauthenticated upload attempts to Elementor endpoints, restrict or disable modules that accept file uploads from unauthenticated users, and hunt for unexpected .php files under wp-content/uploads plus new admin users or modified content as signs of compromise. The high attack complexity (AC:H) means not every install may be exploitable, but patching should be treated as urgent given the reported mass exploitation. | 9.0 | 2% |
| mass≈1,000,000+ WordPress sites (Elementor Pro is the paid add-on to a page builder whose free core has 10M+ active installs) |