Story · 1 source · 1 articlefirst Sep 4, 08:48 UTCupdated Sep 4, 08:48 UTC (12d ago)

WordPress threats: 440,000+ exploit attempts hit Super Forms and Elementor Pro upload flaws while WordPress.org auto-blocks risky plugin releases

criticalExploit / PoCexploited in the wildimportance 82CVE-2026-32475 CVE-2026-14894

What's new: The latest reports consolidate the exploitation picture at more than 440,000 blocked attempts total, including more than 250,000 against Super Forms and more than 190,000 against Elementor Pro, and confirm that Elementor Pro exploitation began immediately after the August 19, 2026 patch. Newer coverage of the WordPress.org supply-chain gate adds more operational detail: the update API blocks…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

Defiant/Wordfence reports more than 440,000 blocked exploit attempts against critical unauthenticated file-upload RCE flaws in Super Forms (CVE-2026-14894) and Elementor Pro (CVE-2026-32475), while WordPress.org has rolled out an automated AI-assisted…

Attackers are mass-exploiting unauthenticated arbitrary file-upload vulnerabilities in two WordPress plugins. In Elementor Pro, CVE-2026-32475 affects form submission handling/the Forms module, affects all versions up to 4.2.1, and was fixed in version 4.2.2, released August 19, 2026. SecurityWeek rates it CVSS 9.8; The Hacker News lists CVSS 9.0/9.8, so the published scores differ slightly. Exploitation began immediately after the August 19 patch shipped, with Defiant reporting more than 190,000 blocked exploit attempts. Successful exploitation requires a published page with a Form widget containing a File Upload field and writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/, enabling remote code execution and full site compromise. As of September 4, roughly two-thirds of Elementor Pro's 10 million installations remained vulnerable. SOCRadar also reported active exploitation of the Elementor Pro Forms module flaw but did not provide a CVE identifier in its report. In Super Forms, CVE-2026-14894 is an unauthenticated arbitrary file-upload flaw caused by missing file type validation, rated CVSS 9.8 and fixed in version 6.3.314. The Hacker News reports exploitation began July 14, 2026, peaked above 40,000 requests on August 18, and has generated more than 250,000 blocked attempts. Across both campaigns, Wordfence has blocked more than 440,000 exploit attempts, and attackers have uploaded Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Separately, WordPress.org has added a supply-chain gate: since June 5, 2026, every plugin and theme release is held in a six-hour cooldown and scored by multiple AI models combined with Jetpack Scan; releases above the risk threshold are automatically blocked from the WordPress.org update API. The change followed a July 28, 2026 incident in which a backdoor was committed to a release of a plugin with roughly 20,000 active installations; after a Wordfence notification, the release was withheld and the compromised plugin was removed/closed for downloads 26 minutes later. Blocked authors are notified of findings and can publish corrected releases or appeal. Administrators are urged to update the affected plugins, scan for indicators of compromise, check /wp-content/uploads/elementor/forms/ for unexpected PHP files, audit unexpected .php files, and review requests to /wp-admin/admin-ajax.php.

Wordfence has blocked more than 440,000 exploit attempts across the two WordPress plugin campaigns.
Super Forms: CVE-2026-14894 is an unauthenticated arbitrary file-upload flaw caused by missing file type validation, rated CVSS 9.8 and fixed in version 6.3.314.
Super Forms exploitation began July 14, 2026, peaked above 40,000 requests on August 18, and accounts for more than 250,000 blocked exploit attempts.
Elementor Pro: CVE-2026-32475 is an unauthenticated arbitrary file-upload flaw in form submission handling/the Forms module, affecting all versions up to 4.2.1 and fixed in version 4.2.2, released August 19, 2026.
SecurityWeek rates Elementor Pro CVE-2026-32475 as CVSS 9.8; The Hacker News lists CVSS 9.0/9.8, so sources disagree slightly on the score.
Defiant has blocked more than 190,000 Elementor Pro exploit attempts, with exploitation beginning immediately after the August 19 patch shipped.
Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field and writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/.
As of September 4, roughly two-thirds of Elementor Pro's 10 million installations were still running a vulnerable version.

VendorsElementor Defiant Automattic Wordfence Patchstack WordPress Jetpack WordPress.org

ProductsElementor Pro WordPress Super Forms Jetpack Scan WordPress.org update API WordPress.org WordPress Plugins

MalwareMushr00w_upl.php

OrganizationsElementor Defiant Wordfence WordPress WordPress Official Plugin Repository Team WordPress.org

Coverage timelineoldest first · each row is one article

Sep 4, 08:48 UTC · 12d ago
The Hacker News· 80
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-14894	The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the sub The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests. NVD description · AI analysis pending	9.8	5%		WordPress	—	Jul 10, 2026
CVE-2026-32475	Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild. Do: Update Elementor Pro to the latest patched release (any version after 4.2.1 — the data does not name a fixed build, so apply the newest available update). Until then, use WAF rules to block unauthenticated upload attempts to Elementor endpoints, restrict or disable modules that accept file uploads from unauthenticated users, and hunt for unexpected .php files under wp-content/uploads plus new admin users or modified content as signs of compromise. The high attack complexity (AC:H) means not every install may be exploitable, but patching should be treated as urgent given the reported mass exploitation.	9.0	2%		Elementor Pro (WordPress plugin) All versions from n/a through 4.2.1 (i.e., every release up to and including 4.2.1)	mass≈1,000,000+ WordPress sites (Elementor Pro is the paid add-on to a page builder whose free core has 10M+ active installs)	27d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-14894

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the sub

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.

NVD description · AI analysis pending

9.8

WordPress

—

Jul 10, 2026

CVE-2026-32475

Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin

Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild.

Do: Update Elementor Pro to the latest patched release (any version after 4.2.1 — the data does not name a fixed build, so apply the newest available update). Until then, use WAF rules to block unauthenticated upload attempts to Elementor endpoints, restrict or disable modules that accept file uploads from unauthenticated users, and hunt for unexpected .php files under wp-content/uploads plus new admin users or modified content as signs of compromise. The high attack complexity (AC:H) means not every install may be exploitable, but patching should be treated as urgent given the reported mass exploitation.

9.0

Elementor Pro (WordPress plugin) All versions from n/a through 4.2.1 (i.e., every release up to and including 4.2.1)

mass≈1,000,000+ WordPress sites (Elementor Pro is the paid add-on to a page builder whose free core has 10M+ active installs)

27d ago