WordPress Plugin Flaws Draw 440,000 Attack Attempts

Attackers have launched more than 440,000 exploit attempts against file upload vulnerabilities in two widely used WordPress plugins, according to telemetry published by the WordPress security company Wordfence. The affected products are Super Forms, a drag-and-drop form builder, and Elementor Pro, a page builder used by many WordPress sites. Both flaws allow someone who is not logged in to upload a file of any type to a vulnerable website, including a file written in PHP, the language WordPress itself is built on. That kind of file can act as a remote control for the server, a condition security professionals call remote code execution (RCE).

The first vulnerability, tracked as CVE-2026-14894, affects Super Forms. It is a missing file type validation flaw with a CVSS severity score of 9.8 out of 10. The bug lets an unauthenticated attacker upload any file type, including an executable PHP file, and then run that file to take control of the site. Super Forms fixed this in version 6.3.314. The second flaw, CVE-2026-32475, affects Elementor Pro and carries a CVSS score listed as 9.0 or 9.8. It also allows unauthenticated attackers to upload PHP files and execute them remotely. Elementor Pro fixed this in version 4.2.2. Wordfence says it has already blocked more than 250,000 exploit attempts against CVE-2026-14894 and more than 190,000 against CVE-2026-32475, for a combined total above 440,000.

For Super Forms, the attack begins with an HTTP POST request to the standard WordPress background processing file at /wp-admin/admin-ajax.php. The request targets a feature called super_submit_form and includes a file field whose content is a long Base64-encoded PHP payload. Base64 is a method of turning raw code into text characters so it can travel inside a web request. The data looks like an image file because it is labelled with data:image/gif;base64, but the actual uploaded file is a small PHP program named Mushr00w_upl.php. That file is a web shell, a script that lets an attacker upload further files or run commands on the server. Wordfence identified a set of source IP addresses for these Super Forms attacks: 103.168.147.235, 103.168.146.131, 103.154.152.178, 103.170.97.7, 182.10.130.51, 189.4.122.140, 129.227.46.143, 64.176.209.104, 103.164.182.122 and 37.9.33.62. The malicious activity began on July 14, 2026 and scaled up to a peak of more than 40,000 exploit requests on August 18, 2026.

For Elementor Pro, the attack uses a slightly different trick to bypass validation. Wordfence explains that the attacker submits the form's file upload field as an array, a list of values. The first element is empty, and the second element carries a PHP payload with a .php file name. That structure triggers a validation bypass, so the server accepts a file it should have rejected. Once written, the uploaded PHP file is placed in the directory /wp-content/uploads/elementor/forms/ under a randomly generated filename that keeps the attacker's .php extension. The attacker can then request that file directly to execute commands on the server. Wordfence says successful exploitation of CVE-2026-32475 requires the target website to have at least one published Elementor page containing a form widget with a file upload field. Details of this flaw were first disclosed by Patchstack last month. Exploitation efforts began on August 19, 2026 and came from these IP addresses: 2602:fa59:10:7a1::1, 185.196.220.85, 103.84.230.85, 103.90.148.202, 216.126.225.208, 167.254.240.75, 167.254.241.119, 114.10.17.253, 114.10.45.151 and 2406:ef80:2:7d19::1.

If an attacker succeeds with either flaw, they can write a PHP web shell to the site and run arbitrary code. From there they can create new administrator accounts, exfiltrate data, or seize control of the entire WordPress site. Wordfence recommends that website owners using either plugin apply the patches immediately, scan their sites for signs of compromise, and audit for unexpected or recently modified .php files. In practical terms, that means looking for new administrator accounts you did not create, checking the upload directories for strange file names, and comparing file timestamps against known changes.

For readers who would rather not handle plugin updates and file audits manually, AEU Hosting provides managed WordPress hosting that is secured end to end, a relevant option for reducing this kind of routine security burden. The most important immediate step remains updating Super Forms to at least version 6.3.314 and Elementor Pro to at least version 4.2.2, then reviewing the site for anything unusual.