Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Summary: Wordfence reports it has blocked more than 250,000 exploit attempts against CVE-2026-14894 in Super Forms and over 190,000 against CVE-2026-32475 in Elementor Pro, both arbitrary file upload flaws that let an attacker write a PHP web shell and execute code on the site. Attacks on the Super Forms flaw began July 14, 2026 and peaked above 40,000 requests on August 18, 2026, while exploitation of the Elementor Pro flaw started August 19, 2026 and requires at least one published Elementor page with a Form widget containing a File Upload field.
Key Takeaway: A single successful upload drops a web shell like Mushr00w_upl.php into /wp-content/uploads/elementor/forms/, from which an attacker can create administrator accounts, exfiltrate data, or take over the entire WordPress site.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-14894 CVE-2026-32475
Related: Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code Cyber Risks ·
⚡ Weekly Recap: AI-Powered PLC Attacks, Git Lab Attacks, Stripe Key Leaks and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026