WordPress site owners are being targeted by a wave of attacks abusing critical vulnerabilities in the Super Forms and Elementor Pro plugins. Security researchers say more than 440,000 exploitation attempts have been blocked, with attackers uploading PHP webshells that can provide remote control of affected websites.
Key takeaways
The incidents affect widely used WordPress tools and require immediate action from site owners.
- Super Forms users should upgrade to version 6.3.314 or later.
- Elementor Pro users should upgrade to version 4.2.2 or later.
- Attackers are uploading PHP files and using them to execute commands remotely.
- Unfamiliar PHP files, administrator accounts and modified plugins may indicate compromise.
- A WordPress maintenance plan can help with patching, monitoring and emergency response.
Two vulnerabilities are being exploited
The first flaw, CVE-2026-14894, affects Super Forms versions 6.3.313 and earlier. Rated critical with a CVSS score of 9.8, it allows unauthenticated visitors to upload arbitrary files through the plugin’s form-submission functionality. More than 250,000 attempts have reportedly been blocked.
The second vulnerability, CVE-2026-32475, affects Elementor Pro 4.2.1 and earlier. It is exploitable when a published form includes a file-upload field. Attackers can abuse faulty validation to upload a PHP file, with nearly 200,000 attempts blocked since exploitation began.
| Plugin | Vulnerable versions | Fixed version | Main risk |
|---|---|---|---|
| Super Forms | 6.3.313 and earlier | 6.3.314 | Unauthenticated file upload and remote code execution |
| Elementor Pro | 4.2.1 and earlier | 4.2.2 | PHP upload through a form file field |
How attackers take control
Super Forms processes data submitted through an unauthenticated AJAX endpoint. Attackers can obtain the required token without an account, disguise PHP code as an image and submit a filename ending in .php. Observed attacks included a webshell called Mushr00w_upl.php.
Elementor Pro attackers use a different validation bypass. By submitting an empty file followed by a malicious PHP file, they can make the plugin stop checking subsequent uploads. The file is then stored in the Elementor forms upload directory and may be called directly to run commands.
Successful exploitation can lead to rogue administrator accounts, data theft, phishing pages, spam campaigns, additional malware and full website takeover.
What site owners should do now
Updating the affected plugins is the most important step, but patching alone may not remove files that attackers have already installed. Administrators should:
- Update Super Forms and Elementor Pro immediately.
- Search writable web directories for unexpected or recently changed PHP files.
- Review logs for suspicious requests involving
super_submit_formor Elementor form uploads. - Check for unknown administrator accounts, scheduled tasks and modified plugins.
- Rotate WordPress, hosting and database credentials if compromise is suspected.
- Restore only from a verified clean backup after investigating the site.
A professional WordPress care plan is particularly useful during incidents like this. Regular updates, malware scanning, off-site backups, uptime monitoring and human review can reduce the time between a vulnerability being disclosed and protection being applied. Site owners who do not routinely monitor their installations should treat this campaign as a prompt to put a maintenance process in place.
Sources
- Critical Elementor Pro flaw exploited to take over WordPress sites, BleepingComputer.
- Hackers Exploit Critical Super Forms WordPress Flaw to Upload Webshells and Execute Code, Cyber Press.
- Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws, The Hacker News.
- Critical Super Forms WordPress Flaw Actively Exploited to Achieve Remote Code Execution, GBHackers News.