# 440,000 Attack Attempts: Super Forms and Elementor Pro RCE Flaws Are Under Active Siege


## The Threat


WordPress sites running Super Forms or Elementor Pro are taking fire. Researchers at Wordfence have documented over 440,000 exploit attempts targeting critical remote code execution vulnerabilities in both plugins — a volume that signals organized, automated campaigns rather than opportunistic probing. When attackers clock nearly half a million attempts, they're not testing the water; they've already committed to a harvest.


The core issue in Super Forms is a missing file type validation flaw: unauthenticated attackers can upload arbitrary files, including PHP webshells, directly through the plugin's form-handling mechanism. No login required, no user interaction needed. A successful upload hands an attacker persistent code execution on the server — the ability to exfiltrate databases, pivot into internal networks, or quietly establish a backdoor for later ransomware staging. The Elementor Pro vulnerability operates on similar RCE territory, exploiting weaknesses in a plugin installed on millions of sites globally.


What makes this particularly dangerous is the target profile. Super Forms and Elementor Pro don't serve niche use cases — they're the workhorses of the WordPress ecosystem, used by agencies, SMBs, and enterprise marketing teams who often lack dedicated security staff. An unauthenticated upload flaw in a drag-and-drop form builder is a skeleton key for the long tail of the web.


## Severity and Impact


| Field | CVE-2026-14894 (Super Forms) | Elementor Pro RCE |

|---|---|---|

| CVE ID | CVE-2026-14894 | Disclosed alongside CVE-2026-14894 |

| CVSS Score | 9.8 (Critical) | Critical |

| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | AV:N/AC:L/PR:L/UI:N |

| Attack Complexity | Low | Low |

| Authentication Required | None | Low-privileged subscriber |

| CWE | CWE-434 (Unrestricted File Upload) | CWE-434 / CWE-862 |

| Exploit Status | Actively exploited in the wild | Actively exploited in the wild |


A CVSS of 9.8 with no authentication requirement is about as bad as web application vulnerabilities get. The attack complexity is low, meaning commodity exploit toolkits can weaponize this — no sophisticated tooling required.


## Affected Products


Super Forms – Drag & Drop Form Builder

  • All versions prior to the patched release
  • Vulnerability class: unauthenticated arbitrary file upload leading to remote code execution

    • Elementor Pro

  • Affected versions as disclosed in Wordfence advisory
  • Vulnerability class: authenticated (low-privilege) remote code execution
  • Note: Elementor (free) is not confirmed affected — this pertains specifically to the Pro tier

    • Both plugins have installations numbering in the millions across the WordPress ecosystem. Site owners running multi-plugin page builders should audit all active form and page-builder plugins, not just these two, as campaign actors often chain vulnerabilities across co-installed products.


    ## Mitigations


    Immediate actions — do these now:


  • Update Super Forms to the latest patched version immediately. If you cannot update within 24 hours, temporarily deactivate the plugin and disable form submission endpoints at the web server or WAF layer.
  • Update Elementor Pro to the patched release. Wordfence's firewall rules for premium subscribers include virtual patching for this flaw.
  • Audit recent uploads: Check your /wp-content/uploads directory and any custom upload paths for unexpected .php, .phtml, or .phar files. A webshell planted before patching remains active after the update.
  • Review user accounts: Unauthenticated upload flaws sometimes arrive with account creation payloads. Look for unfamiliar subscriber or contributor accounts created in the past 30 days.

    • Layered defenses:


  • Enable Wordfence (or an equivalent WAF) with real-time threat intelligence; virtual patches are available now for subscribers.
  • Restrict PHP execution in upload directories via .htaccess or server config — this limits the damage even if an attacker successfully uploads a file.
  • Implement file type allowlisting at the server level: upload directories should never execute .php files regardless of what any plugin permits.
  • Enable login notifications and monitor for new privileged account creation.
  • Consider network-level segmentation: WordPress servers should not have direct outbound internet access to command-and-control infrastructure.

    • If you suspect compromise:


    Treat it as an incident. Pull logs, look for webshell activity (unusual POST requests to /wp-content/uploads/), check cron jobs for persistence mechanisms, and rotate all credentials including database passwords and API keys stored in wp-config.php.


    ## References


  • Wordfence Threat Intelligence Blog — primary advisory source
  • WordPress Plugin Directory: Super Forms – Drag & Drop Form Builder
  • Elementor Pro official changelog and security disclosure
  • NIST NVD entry for CVE-2026-14894
  • [HackWire Vulnerabilities Coverage](https://www.hackwire.news/category/vulnerabilities)

    • ---


    ## HackWire Analysis


    Four hundred and forty thousand exploit attempts is not a signal — it's a statement. Whoever is running these campaigns has automated infrastructure, a curated list of WordPress targets, and the patience to run broad sweeps. This isn't a lone researcher testing a proof-of-concept; this is threat actors with tooling treating the WordPress long tail as an asset to be liquidated.


    The Super Forms CVE-2026-14894 fits a pattern we've seen repeatedly with form-builder plugins: file upload handling is deceptively hard to secure, and developers often add it as an afterthought without understanding the execution implications on shared hosting environments. CWE-434 — unrestricted file upload — has been on security advisories for over a decade, yet it keeps appearing in popular plugins because testing for it requires security intentionality that most plugin developers simply don't prioritize.


    What other outlets are underreporting here: the real exposure isn't the Fortune 500 WordPress install managed by a security-conscious DevOps team. It's the small law firm, the regional healthcare provider, the regional e-commerce shop running an Elementor Pro page the marketing agency built three years ago and nobody has touched since. These organizations often don't have Wordfence premium, don't monitor upload directories, and won't see the compromise until ransomware drops or their site starts serving pharma spam.


    The actionable advice defenders need isn't just "patch" — it's to audit everything in the /wp-content/uploads/ path right now, before confirming whether a patch has been applied. If attackers have already been through your site in the last few weeks, patching closes the door but doesn't evict the tenant. For organizations running WordPress at scale, this is a strong argument for investing in SIEM-level log aggregation for web application traffic, not just endpoint detection. PHP webshells are stealthy until they're not.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)