WordPress Under Siege: Over 440,000 Exploit Attempts Target Critical RCE Flaws in Super Forms and Elementor Pro
Executive Summary
Threat intelligence researchers at Wordfence have detected a massive automated exploitation campaign generating more than 440,000 attack attempts against WordPress websites within a matter of days (The Hacker News). The coordinated attacks target two critical arbitrary file upload vulnerabilities—CVE-2026-14894 (CVSS 9.8) in Super Forms – Drag & Drop Form Builder and CVE-2026-32475 (CVSS 9.8) in Elementor Pro—allowing unauthenticated remote attackers to upload executable PHP web shells and achieve total server takeover.
Deep-Dive Technical Analysis
Arbitrary File Upload Vectors & Automated Web Shell Drops
Both vulnerabilities stem from missing or insufficient server-side file type and extension validation routines during asynchronous form submissions:
1. Super Forms Vulnerability (CVE-2026-14894, CVSS 9.8): The drag-and-drop form builder plugin failed to enforce server-side MIME-type and extension restrictions during file upload handling. Unauthenticated visitors can transmit multipart form requests containing arbitrary executable scripts (such as .php, .phtml, or .php5 files) directly to publicly exposed upload handlers. (Resolved in Super Forms version 6.3.314).
2. Elementor Pro Vulnerability (CVE-2026-32475, CVSS 9.8): The premium website builder's Form Widget similarly failed to adequately validate uploaded file contents and extensions on specific endpoint actions, permitting unauthenticated file placement directly into the site's media directory. (Resolved in Elementor Pro version 4.2.2).
3. Automated Exploit Anatomy: Wordfence telemetry tracked distributed botnets scanning public WordPress installations at scale. Upon identifying vulnerable plugin endpoints, automated scripts issue POST requests to drop lightweight PHP backdoors into /wp-content/uploads/ subdirectories.
4. Post-Exploitation Activity: Once the web shell is established, attackers execute secondary commands to dump the wp-config.php database configuration, harvest administrative credentials, inject rogue administrator accounts, and deploy SEO spam or crypto-draining redirect scripts.
Content Management System (CMS) Ecosystem Blast Radius
WordPress powers over 40% of the world's websites, making high-profile plugin flaws primary targets for opportunistic threat actors:
* Automated Mass Exploitation: As soon as proof-of-concept exploits for arbitrary file uploads surface, botnets operationalize them within hours, indiscriminately targeting hundreds of thousands of small businesses, ecommerce stores, and enterprise blogs.
* Persistent Web Shell Infection: Web shells deposited in neglected upload directories frequently persist undetected for months, allowing adversaries to sell unauthorized access to ransomware syndicates or use compromised servers as proxy nodes for secondary attacks.
Actionable Recommendations & Mitigations
1. Update Plugins Immediately: Ensure Super Forms is upgraded to version 6.3.314 or higher and Elementor Pro is updated to version 4.2.2 or higher without delay.
2. Disable PHP Execution in Upload Directories: Configure web server rules (via Apache .htaccess or Nginx configuration) to block PHP script execution inside /wp-content/uploads/, rendering dropped web shells unexecutable.
3. Deploy Web Application Firewalls (WAF): Implement WAF rules to inspect multipart form uploads and block incoming requests containing executable script extensions.
4. Scan for Web Shell Artifacts: Conduct immediate integrity scans of all WordPress root and upload directories to detect and eliminate unauthorized PHP files or newly created administrative user accounts.
________________
Sources & References: The Hacker News.