WordPress Under Fire: Super Forms and Elementor Pro Upload Flaws Draw 440,000+ Exploit Attempts
WordPress Under Fire: Super Forms and Elementor Pro Upload Flaws Draw 440,000+ Exploit Attempts
Two critical file-upload vulnerabilities in popular WordPress plugins are being exploited in the wild at massive scale. Wordfence, the WordPress security firm, has blocked more than 250,000 exploit attempts against the Super Forms form builder and more than 190,000 attempts against Elementor Pro — a campaign that gives unauthenticated attackers a straightforward path from a crafted form submission to full site takeover.
Super Forms: Two Unauthenticated Requests to RCE
The Super Forms flaw, CVE-2026-14894 (CVSS 9.8), affects the drag-and-drop form builder's submit_form function — reachable by unauthenticated visitors. The handler skips file-type validation and capability checks; the only barrier is a session nonce that a separate public endpoint hands out on demand. Exploitation drops to just two unauthenticated requests: fetch a nonce, then submit a base64 payload with a .php filename that the plugin writes to disk. The result is a webshell and, from there, remote code execution and complete site compromise.
Attacks began on July 14, 2026 — the same day the firewall rule shipped — with a sharp spike between August 18 and 25. The dropped webshells often carry "Mushr00w" branding, a name matching a group tied to a recent government-site defacement, though Wordfence cautions that hacker attributions can be swapped out easily. Wordfence estimates around 13,000 active installations; the flaw affects all versions up to 6.3.313, with the patched 6.3.314 build released on July 8.
Elementor Pro: Empty Slot, Loaded Payload
Days later, attention shifted to Elementor Pro (CVE-2026-32475, CVSS 9.8), the paid tier of a page builder whose free version counts over 10 million installations. The bug lives in the form widget's upload handling: when the validation loop encounters an upload slot marked as empty, it triggers an error and returns — aborting validation of the remaining files in the field. An attacker submits the field as an array with two parts: an empty slot that triggers the early return, followed by a PHP payload that is written to /wp-content/uploads/elementor/forms/ without ever being checked. The flaw was patched in version 4.2.2 on August 19, and attackers began exploiting immediately after the fix landed. As of September 4, roughly two-thirds of Elementor's installations were still running a vulnerable version.
What Should You Do?
- Update both plugins immediately — Super Forms to 6.3.314 or later, Elementor Pro to 4.2.2 or later.
- Hunt for indicators of compromise. Check
/wp-content/uploads/elementor/forms/for PHP files — a strong indicator — and scan for recently modified or unexpected PHP files across all upload directories. - Review logs for requests to
/wp-admin/admin-ajax.phpcarrying multipart form arrays. - Assume follow-on compromise. A planted webshell means checking for backdoors, rogue admin accounts, and secondary payloads — not just deleting the file.
The WAF Angle
Both exploits are plain HTTP POSTs with crafted file fields — exactly the request shape a WAF inspects best. Wordfence's firewall, itself a WAF, blocked nearly half a million attempts across the two flaws. If you run WordPress behind any WAF, verify that your file-upload rules normalize multipart arrays (the empty-slot trick specifically abuses naive parsing) and block PHP extensions in upload paths as a compensating control. But the rule is unchanged from every WordPress campaign before this one: the WAF buys time, the patch ends the incident.
