Over 440,000 Exploit Attempts Hit WordPress Plugin RCE Flaws
Threat actors have launched more than 440,000 exploit attempts against two critical remote code execution (RCE) vulnerabilities in widely deployed WordPress plugins—Super Forms and Elementor Pro—according to telemetry published this week by Wordfence. Both flaws trace back to missing file type validation logic that allows unauthenticated attackers to upload arbitrary files, including executable PHP web shells, to vulnerable sites.
The Super Forms flaw, tracked as CVE-2026-14894 with a CVSS score of 9.8, affects the Drag & Drop Form Builder plugin and was remediated in version 6.3.314. In active attacks observed by Wordfence, threat actors have issued HTTP POST requests to /wp-admin/admin-ajax.php through the super_submit_form endpoint, injecting a Base64-encoded PHP payload disguised as an image via a manipulated sf_upload_field parameter. Wordfence said it has blocked more than 250,000 attempts targeting this specific vector. The embedded payload—a "mushr00w uploader" backdoor rendered as a styled HTML form—has become a recognizable fingerprint of the campaign.
The second vulnerability, CVE-2026-32475 (CVSS 9.0/9.8), affects Elementor Pro and was disclosed by Patchstack last month before being patched in version 4.2.2. Successful exploitation requires at least one published page to contain a Form widget with a File Upload field enabled, and Wordfence has blocked roughly 190,000 additional exploit attempts against this flaw. Attackers who successfully leverage either vulnerability can plant a PHP web shell, escalate to administrative access, exfiltrate database contents, or assume full control of the underlying WordPress installation.
Site administrators should immediately upgrade Super Forms to version 6.3.314 or later and Elementor Pro to version 4.2.2 or later. Post-patching, defenders are advised to audit server logs for anomalous super_submit_form requests or unexpected PHP files in upload directories, rotate all administrator credentials—and validate their strength with a password checker—confirm proper TLS deployment via an SSL/TLS checker, and run a port scanner against the hosting environment to surface any webshells, reverse-shell listeners, or persistent backdoors left behind by the attackers.