A large wave of automated attacks is targeting two critical WordPress plugin vulnerabilities that can let unauthenticated users upload executable PHP files. Security telemetry indicates that more than 440,000 exploit attempts have already been blocked across sites using vulnerable versions of Super Forms and Elementor Pro.
File Upload Features Become Code Execution Paths
The Super Forms vulnerability, CVE-2026-14894, results from inadequate validation of uploaded file types. Attackers can submit a request containing a Base64-encoded PHP payload disguised with an image content type. If the request succeeds, the uploaded file can act as a web shell and provide a platform for additional malware, administrator-account creation or data theft.
The second vulnerability, CVE-2026-32475, affects Elementor Pro. Exploitation requires a published Elementor page containing a Form widget with a File Upload field. Attackers can manipulate the submitted file structure to bypass validation and place a PHP file inside the site's uploads directory, where it can be requested directly.
Super Forms fixed its issue in version 6.3.314, while Elementor Pro addressed its vulnerability in version 4.2.2. Wordfence reported blocking more than 250,000 attempts against Super Forms and roughly 190,000 attempts targeting Elementor Pro.
Compromise Can Extend Beyond One Website
A vulnerable WordPress installation may appear to be only a marketing or content-management asset, but it can hold customer records, administrative credentials, payment integrations and connections to internal services. Attackers can also use compromised sites to distribute malware, host phishing pages, manipulate search results or redirect visitors.
Updating the plugin closes the known vulnerability but does not remove files uploaded before the patch. Administrators therefore need to combine patching with an investigation for persistence.
Immediate Defensive Steps
- Upgrade Super Forms to version 6.3.314 or later.
- Upgrade Elementor Pro to version 4.2.2 or later.
- Search upload directories for unexpected or recently modified PHP files.
- Review newly created WordPress administrator accounts and scheduled tasks.
- Rotate credentials if web shells or unauthorized changes are discovered.
- Restrict PHP execution inside directories intended only for uploaded media.
In my view, the volume of exploit attempts illustrates how quickly plugin weaknesses become industrialized. WordPress administrators should not assume that a small or low-traffic site will be ignored. Automated scanners do not care about an organization's size. They look for vulnerable software, and a forgotten website can become the easiest route into a broader digital environment.