Over 440,000 Exploit Attempts Target Super Forms & Elementor Pro

Wordfence researchers reported that over 440,000 exploit attempts were observed targeting two widely used WordPress plugins—Super Forms and Elementor Pro—after discovering a critical flaw that allows unauthenticated attackers to upload files of any type through the drag‑and‑drop form builder ¹. The vulnerability is identified as CVE‑2026‑14894 and carries a high severity score of 9.8 on the Common Vulnerability Scoring System (CVSS).

The core issue lies in a lack of validation on uploaded file types within Super Forms’ drag‑and‑drop interface. Because the plugin does not enforce MIME type or extension checks, an attacker can submit arbitrary files—including malicious PHP web shells—that are then served directly by the site’s own web server. Once placed, these files enable remote code execution (RCE) without requiring user interaction or authentication ¹. Similar vulnerabilities have appeared before; for example, Duplicator earlier this year allowed full control over sites running vulnerable versions via unvalidated uploads. WordPress core requires signature verification for extensions, but many third‑party plugins lag behind best practices due to rapid development cycles.

Elementor Pro also suffers from related RCE flaws, meaning sites that employ both plugins simultaneously face compounded risk. Many website owners use both tools together because they complement each other’s functionality: Super Forms handles complex data collection while Elementor provides advanced page building capabilities. When combined, attackers can exploit either plugin’s upload flaw to gain foothold into the same host environment. This scenario mirrors past widespread malware infections through Drupal modules back around 2013 when similar unvalidated upload bugs were exploited at scale.

Given the severity and volume of attempts, administrators should immediately update both plugins to their latest releases, which reportedly contain proper file‑type validation logic. Site owners must also audit any custom form builders or legacy instances still using older plugin versions, as those may remain exposed. In addition, implementing a strict content security policy—restricting executable MIME types—and monitoring server logs for anomalous POST requests will help detect ongoing attack attempts.

Finally, maintaining regular backups and applying patches promptly are essential defenses against such exploitation vectors. The sheer number of observed attacks underscores how quickly a single oversight in input validation can become a global threat vector across thousands of websites.