WordPress Site Owners Face Mass Exploitation of Super Forms and Elementor Pro Upload Flaws

WordPress Site Owners Face Mass Exploitation of Super Forms and Elementor Pro Upload Flaws

Two critical WordPress plugin flaws are now being exploited at scale, and the practical takeaway is direct: sites running vulnerable versions of Super Forms or Elementor Pro should be patched and reviewed for signs of compromise immediately.

Wordfence reported this week that attackers have already launched more than 440,000 blocked exploit attempts across two unauthenticated file-upload vulnerabilities: CVE-2026-14894 in Super Forms - Drag & Drop Form Builder and CVE-2026-32475 in Elementor Pro. Both flaws can let unauthenticated attackers upload PHP files to a vulnerable WordPress site, which can lead to remote code execution, administrator account creation, data theft, spam placement, phishing kits, or full site takeover.

The risk is not theoretical. Wordfence says exploitation against Super Forms began on July 14, 2026, only days after disclosure, and later peaked above 40,000 exploit requests in a single day on August 18. Elementor Pro exploitation started on August 19, the same day the issue was publicly disclosed. The volume matters because WordPress plugin bugs tend to become commodity internet scanning targets quickly once a reliable request pattern is available.

What is being exploited

CVE-2026-14894 affects Super Forms versions up to and including 6.3.313. The flaw sits in how the plugin processes submitted file fields. According to Wordfence, an unauthenticated visitor can obtain the needed nonce through a separate unauthenticated endpoint, then submit a crafted request that carries Base64-encoded PHP content and an attacker-controlled filename. Because the vulnerable code does not properly validate the file type or extension, the payload can be written to disk as executable PHP.

The vendor patched Super Forms in version 6.3.314. Wordfence says its firewall has blocked more than 250,000 exploit attempts targeting this vulnerability, with several source IPs responsible for large shares of observed traffic.

CVE-2026-32475 affects Elementor Pro versions up to and including 4.2.1. This issue is also an unauthenticated file-upload vulnerability, but the trigger is different. Exploitation requires a published Elementor page containing a Form widget with a File Upload field. Attackers submit the file upload field as an array, where an empty first element causes validation to stop early and a later element carries a PHP file. If successful, the uploaded file lands under the Elementor forms upload path and can be requested directly.

Elementor Pro patched the issue in version 4.2.2. Wordfence says it has blocked more than 190,000 attempts against the flaw since public disclosure.

Why this deserves immediate attention

File-upload bugs in content management systems are especially dangerous because they often collapse the distance between "visitor" and "server execution." Once a PHP web shell is placed on a site, the attacker does not need to exploit the original bug again. They can use the shell as a control point to upload more malware, alter site content, create hidden administrator accounts, stage phishing pages, or pivot into databases and configuration files.

That persistence angle is what makes patching necessary but incomplete. Updating the plugin closes the entry point, but it does not automatically remove a web shell or undo an administrator account that was created before the patch. For site operators, the right sequence is patch, inspect, clean, rotate credentials where needed, and keep monitoring.

The Elementor Pro case is also notable because of scale. Elementor Pro is widely used, and Wordfence cites more than 6 million active installations. Even if only a subset of sites expose the vulnerable form configuration, attackers can scan broadly and cheaply. Super Forms has a smaller install base, but the exploit path described by Wordfence is highly direct and has already drawn concentrated activity.

What defenders should do now

Start with asset and plugin inventory. Confirm whether any production, staging, marketing, microsite, or abandoned WordPress instance uses Super Forms or Elementor Pro. Internet-facing "small" sites often sit outside normal patch cadence, but they still hold credentials, cookies, customer forms, CMS accounts, analytics tokens, and mail-sending capability.

Then patch:

• Update Super Forms to version 6.3.314 or later.
• Update Elementor Pro to version 4.2.2 or later.
• If patching cannot be completed immediately, disable the affected plugin or remove vulnerable upload forms until the update is verified.

After patching, review for compromise:

• Search the WordPress filesystem for unexpected or recently modified .php files, especially under upload directories.
• For Super Forms, review access logs for requests to /wp-admin/admin-ajax.php using the super_submit_form action.
• For Elementor Pro, review requests involving elementor_pro_forms_send_form and file uploads to Elementor form paths.
• Check for unknown administrator accounts, newly installed plugins, suspicious scheduled tasks, and modified theme files.
• Review outbound mail behavior and web server logs for spam, redirects, phishing pages, or command execution traces.

If indicators appear, treat the site as compromised and run an incident response process rather than a simple update. Remove web shells, restore clean files, rotate CMS, database, hosting, FTP/SFTP, API, and SMTP credentials, and verify that backups predate the intrusion before restoring from them.

The bigger lesson

This campaign is a reminder that WordPress security is often less about one dramatic zero-day and more about exposure management. File upload features are business-friendly, but they sit close to executable server paths, media directories, and user-controlled content. When validation fails, attackers get a fast route from a public form to code execution.

Security teams should not wait for a plugin to appear in every alert feed before acting. For widely deployed CMS plugins, a critical unauthenticated file upload should be treated as internet-wide exploitation material as soon as technical details or traffic patterns become public.

For managed service providers and agencies, this is also a client inventory problem. One forgotten landing page with a vulnerable form plugin can become the foothold that damages a brand, sends phishing traffic, leaks form submissions, or causes search engine blocklisting.

References

1. https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/
2. https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-elementor-pro-plugin/
3. https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html