WordPress Under Fire: Over 440,000 Exploit Attempts Target Two Critical Plugins in Days

Threat actors have launched more than 440,000 exploit attempts against two unauthenticated arbitrary file upload vulnerabilities in widely used WordPress plugins, peaking at 40,000 requests in a single day. The campaigns, detected by Wordfence, targeted CVE-2026-14894 in Super Forms and CVE-2026-32475 in Elementor Pro, both rated critical and both enabling remote code execution on victim servers. The data emerged on September 4, 2026, from a convergent analysis of technical sources and vendor intelligence.

The Attack Mechanism: How Validation Is Bypassed on Two Fronts

The two vulnerabilities share an identical attack surface — unauthenticated file upload leading to PHP web shells — but implement different bypass techniques, both documented in the technical analyses from the sources.

For CVE-2026-14894 in Super Forms, the exploit sends an HTTP POST request to the /wp-admin/admin-ajax.php endpoint with action super_submit_form. The payload is Base64-encoded inside a datauristring field, disguised as image/gif, but decodes to a PHP web shell named Mushr00w_upl.php. The file acts as a conduit for additional payloads, enabling arbitrary command execution on the server. Commit c5838f5 on the Super Forms GitHub repository, explicitly tagged as v6.3.314, confirms the hardening: extension neutralization via str_replace('.', '_', $stem), magic bytes validation for %PDF-, and path traversal protection via realpath.

For CVE-2026-32475 in Elementor Pro, the technique is more subtle. According to Patchstack's analysis published on BleepingComputer, "the validation loop and the processing loop have different early-exit logic for these empty entries" — a multi-part upload whose filename is empty, which PHP flags as UPLOAD_ERR_NO_FILE. The attacker submits the File Upload field as an array where "the first element is empty and the second element carries a PHP payload with a .php extension," as reported by Wordfence via The Hacker News. The empty element triggers early exit in the validation loop, while the processing loop still handles the second element. The uploaded file lands in /wp-content/uploads/elementor/forms/ with a uniqid()-generated name but the attacker-supplied .php extension, directly executable via HTTP request.

"The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover."

The Compressed Window: Same-Day Exploit for Elementor Pro

The attack timeline reveals a disturbing pattern in the commoditization of WordPress exploits. For Super Forms, the timeline shows a 36-day gap: public disclosure dates to July 14, 2026, with a peak of 40,000 requests on August 18 and the September report. This gap suggests an initial phase of more contained exploitation or different actor dynamics.

For Elementor Pro, however, attacks began on August 19, 2026 — "the same day the vulnerability became public," as confirmed by both The Hacker News and SecurityOnline.info. BleepingComputer, in an article dated August 20, 2026, had explicitly noted that no active exploit activity had been observed, predicting the actual campaign launch by one day. This collapse of the patch-to-exploitation window to zero days indicates threat actors actively monitor vulnerability disclosures and possess ready-to-deploy tooling.

The parallel between the two plugins — different vendors, different bypass mechanisms, same compromised upload directory, same PHP web shell objective — suggests the existence of commoditized exploitation tooling for the WordPress ecosystem, rather than targeted activity by individual groups.

Impact on the WordPress Ecosystem: Millions of Installations Exposed

WordPress powers over 43% of the web. Elementor, the visual builder, counts over 10 million active installations for the base version; SecurityOnline.info states over 6 million sites for Elementor Pro. Super Forms, while having fewer installations, remains an established plugin for drag-and-drop form building. The combined exposure is massive.

Unauthenticated remote code execution enables full site takeover: data theft, SEO spam injection, cryptomining, lateral movement within the hosting network, and use of the compromised server as a platform for further attacks. Wordfence blocked over 440,000 attempts, but the figure covers only traffic intercepted by its sensors. The number of sites actually compromised remains unquantified in the sources. Moreover, the sources explicitly emphasize that applying the patch does not remove malicious files already uploaded during the exposure window: a patched site can still host active backdoors.

What to Do Now

• Immediately verify the Super Forms version: update to 6.3.314 or later, confirmed as fixed by GitHub commit c5838f5 and technical sources.
• Immediately verify the Elementor Pro version: update to 4.2.2 or later, confirmed as fixed by The Hacker News, SecurityOnline.info, and BleepingComputer/Patchstack.
• Audit files in /wp-content/uploads/elementor/forms/ for Elementor Pro and Super Forms upload directories for unauthorized PHP files, given confirmation that patches do not remove pre-existing backdoors.
• Review access logs for requests to /wp-admin/admin-ajax.php with action super_submit_form or multi-part array submissions to the Elementor Pro File Upload field, looking for Base64 payloads or .php extensions in fields that should contain only media.

When the Patch Is No Longer Enough

The campaign documents a structural inversion in WordPress risk management. No more vulnerabilities waiting weeks before weaponization; no more grace period for complacent administrators. The same-day exploit of Elementor Pro, combined with the 36-day window for Super Forms, traces a spectrum of actor behaviors: from patient monitoring of disclosures to immediate deployment of pre-packaged tooling.

The most relevant datum for operational security is not the number of blocked attempts, but what the sources do not say: no attribution to specific groups, no estimate of successful compromises, no meaningful geographic map. This opacity, in an ecosystem where over 440,000 attempts generate only an aggregate signal, is itself an indicator of offensive automation scalability. The stakes are no longer the single vulnerability, but the speed at which the update infrastructure of millions of independent sites can react to a threat that materializes the same day it is revealed.

Information verified against cited sources and current as of publication.

Sources

• https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-14894
• https://www.theexploitdesk.tech/article/cve-2026-14894-cvss-9-8-critical-the-super-forms-drag-drop-form-builde-67037c
• https://securityonline.info/elementor-pro-vulnerability/
• https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/
• https://github.com/RensTillmann/super-forms/commit/c5838f5877c72b738c54ed970935c77ae6830c3a
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence