Wordfence Logs 440K Attacks on Super Forms and Elementor Pro

Wordfence said it has blocked more than 440,000 exploit attempts aimed at two critical WordPress plugin vulnerabilities in Super Forms and Elementor Pro, a wave that shows how quickly attackers move after file-upload bugs become public. The two flaws allow unauthenticated visitors to upload a file of any type, including an executable PHP file, to a vulnerable website, which can lead to full remote code execution (meaning the attacker can run their own commands on the server) and a takeover of the entire WordPress site.

The first flaw, tracked as CVE-2026-14894, affects Super Forms Drag and Drop Form Builder. It is a missing file type validation weakness with a CVSS severity score of 9.8 out of 10. Because the plugin does not check what kind of file is being submitted, an attacker who does not need to log in can send a crafted upload request. The request targets the super_submit_form endpoint on wp-admin/admin-ajax.php and carries a Base64-encoded PHP payload disguised with a data:image/gif;base64 prefix. The file is then written to the server as a PHP web shell named Mushr00w_upl.php. A web shell is a small backdoor script that lets the attacker run commands on the hosting server and upload further malware. Super Forms fixed this in version 6.3.314.

The second flaw, CVE-2026-32475, affects Elementor Pro. It also carries a high CVSS score, listed as 9.0 in some references and 9.8 in others. Wordfence describes an upload validation bypass: the attacker submits the form's File Upload field as an array, meaning a list of two values in one field. The first value is empty, and the second value carries a PHP payload with a .php file name. This structure tricks the plugin into accepting the file. Successful exploitation requires that the target site has at least one published Elementor page that contains a Form widget with a File Upload field. Once the file lands in the /wp-content/uploads/elementor/forms/ directory under a random name but with the attacker-supplied .php extension, the attacker can request it directly to execute arbitrary commands. Elementor Pro fixed this in version 4.2.2. Patchstack disclosed details about this flaw last month.

Wordfence published two reports this week describing the attacks. The company has already blocked more than 250,000 exploit attempts against CVE-2026-14894 and more than 190,000 against CVE-2026-32475, for a combined total of over 440,000. The Super Forms attacks began on July 14, 2026 and peaked with more than 40,000 requests on August 18, 2026. Wordfence listed ten IP addresses linked to those attempts: 103.168.147.235, 103.168.146.131, 103.154.152.178, 103.170.97.7, 182.10.130.51, 189.4.122.140, 129.227.46.143, 64.176.209.104, 103.164.182.122, and 37.9.33.62. The Elementor Pro exploitation began on August 19, 2026, and originated from ten IP addresses: 2602:fa59:10:7a1::1, 185.196.220.85, 103.84.230.85, 103.90.148.202, 216.126.225.208, 167.254.240.75, 167.254.241.119, 114.10.17.253, 114.10.45.151, and 2406:ef80:2:7d19::1.

These are not theoretical risks. An attacker who successfully exploits either flaw can write a PHP web shell to the site and run arbitrary code. From there, they can create new administrator accounts, steal data, or take over the whole WordPress installation. An arbitrary file upload flaw is especially dangerous on WordPress because uploads are usually stored inside a publicly accessible folder. When a hosting server receives a request for a .php file in that folder, it may execute the code instead of showing it as a download. That is why attackers rename a web shell with a .php extension and then access it directly. For a typical website owner, the practical effect is that a single outdated plugin can turn into a full site takeover without any visible sign until it is too late.

WordPress site owners using either plugin should apply the fixes immediately, look for signs that a site has been accessed by an attacker, and check for any unexpected or newly changed .php files. For sites hosted on AEU Hosting, the managed WordPress hosting service from AEU Group, the platform's security-focused management can help keep WordPress core and plugins up to date and monitored, but applying the vendor patch remains the critical action. After patching, check the affected upload directories carefully and remove any web shell files that may have already been placed.