Two WordPress Plugins Are Being Hit With 440,000 Exploit Attempts
- The Mess: Two WordPress plugins turned file uploads into unauthenticated remote code execution. Attackers have already launched more than 440,000 exploitation attempts.
- The Damage: A vulnerable WordPress site can become an attacker-controlled server without the attacker ever obtaining a WordPress account.
- The Fix: Patch Elementor Pro and Super Forms immediately, then inspect affected sites for uploaded PHP files and unauthorized changes.
WordPress has another problem that looks small in a plugin list and enormous on the internet.
Two popular plugins — Elementor Pro and Super Forms — were hit by critical arbitrary file-upload vulnerabilities. Both carry CVSS 9.8, and exploitation is already happening. Security researchers have observed more than 440,000 attack attempts against the two flaws combined.
The Elementor Pro vulnerability is tracked as CVE-2026-32475.
The Super Forms vulnerability is CVE-2026-14894.
The basic attack is brutally effective:
unauthenticated request → malicious file upload → executable code → WordPress takeover
Elementor Pro Has Six Million Targets
Elementor Pro is the bigger problem by sheer deployment size.
The vulnerable versions include releases up to and including 4.2.1. The flaw involves unrestricted file-type uploads through the plugin’s form functionality. An attacker can abuse a published Elementor Pro form containing a File Upload field to upload a file that the server may execute.
No WordPress account is required.
No administrator interaction is required.
The victim doesn’t need to click anything.
The condition that makes the attack possible is fairly specific: the targeted site needs an Elementor Pro Form widget with at least one non-required File Upload field.
That still leaves an enormous pool of potential targets.
Wordfence reported blocking more than 190,000 exploitation attempts against CVE-2026-32475.
Super Forms Has the Same Basic Failure
Super Forms has a similar unrestricted file-upload vulnerability.
The affected versions go through 6.3.313.
The plugin has roughly 13,000 active installations, substantially fewer than Elementor Pro, but the exploitation volume is still significant.
Wordfence recorded more than 250,000 attack attempts against the Super Forms vulnerability.
Add the numbers together and the result is ugly:
440,000+ blocked exploitation attempts.
That’s not background internet noise.
Someone is actively looking for vulnerable WordPress installations.
File Uploads Are an Old Problem With a New Body Count
File-upload functionality is deceptively dangerous.
The application has to answer several questions correctly:
- What file type was submitted?
- What content is actually inside it?
- Where will the file be stored?
- Can the web server execute it?
- Can the uploaded file be accessed directly?
- Can the filename manipulate server-side processing?
- Can an attacker bypass extension restrictions?
Getting one of those wrong can turn a form into an execution primitive.
For WordPress, the consequences can be immediate.
A successful attacker may be able to install a webshell, modify PHP files, create administrator accounts, inject JavaScript into pages or use the compromised site as infrastructure for additional attacks.
The vulnerability doesn’t need to give the attacker a WordPress login.
It can simply give them a file.
If the server executes that file, the authentication boundary has already failed.
The Attack Volume Is the Real Warning
The CVSS scores are already enough to justify emergency patching.
The exploitation telemetry makes the situation much harder to ignore.
Wordfence’s figures show hundreds of thousands of attempts against the two vulnerabilities.
This is exactly the kind of vulnerability automated scanners love.
They don’t need to know who owns the website.
They don’t need to understand its content.
They can scan for vulnerable plugin versions, locate suitable forms and send the payload.
One successful request can be enough.
Patching Is Only Step One
If a site was running a vulnerable version while exposed to the internet, updating the plugin should not be considered proof that the incident is over.
Administrators should also check:
- recently modified PHP files;
- unexpected files inside upload directories;
- new WordPress administrator accounts;
- modified plugin or theme files;
- suspicious cron jobs;
- unknown JavaScript injected into pages;
- unusual outbound connections;
- web-server logs around the first suspicious requests.
Forensic checks matter because the attack may have happened before the administrator noticed the plugin vulnerability.
Deleting a malicious file and installing the update is not the same as investigating compromise.
Bugstoday Opinion
WordPress doesn’t have a “plugin problem.”
It has an execution-boundary problem.
Every plugin that accepts files, processes requests or touches PHP expands the amount of code standing between an anonymous HTTP request and the server.
Elementor Pro demonstrates the scale.
Super Forms demonstrates the automation.
Together they produced more than 440,000 exploitation attempts.
And that’s just what security researchers saw being blocked.
If your WordPress installation exposes a vulnerable upload handler, the attacker doesn’t need your password.
They just need your plugin.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Wordfence Intelligence
- CVE-2026-32475 — Elementor Pro
- CVE-2026-14894 — Super Forms
- WordPress Plugin Security Advisories
- NVD
