Hackers Fire 440,000 Attacks at Two Popular WordPress Plugins
Flaws in Super Forms and Elementor Pro let attackers upload files and run code on unpatched sites, with mass exploitation already underway.
Key points
- Wordfence recorded more than 440,000 exploit attempts against two WordPress plugins, Super Forms and Elementor Pro, in recent weeks.
- CVE-2026-14894 in Super Forms lets unauthenticated attackers upload any file type, including code that runs on the server, and carries a critical severity score of 9.8.
- A second critical flaw affects Elementor Pro, the paid version of the widely used page-builder plugin.
- Site owners running either plugin should update immediately and check for unfamiliar files or admin accounts.
- WordPress powers roughly 43% of all websites, so plugin flaws at this scale hit small businesses hardest.
Criminals are hammering two popular WordPress add-ons, and the numbers are not small. Security firm Wordfence says it has logged more than 440,000 attempts to break into sites running vulnerable versions of Super Forms and Elementor Pro.
Both plugins are common on small business websites: contact forms, landing pages, online bookings. If your site uses either, this affects you.
What are the flaws?
The more serious bug sits in Super Forms, a drag-and-drop form builder. Tracked as CVE-2026-14894, it scores 9.8 out of 10 on the standard severity scale. The plugin fails to check what kind of file a visitor is uploading. That means an attacker who has never logged in can send a PHP file, which is code the web server will happily run, and take over the site.
The second flaw affects Elementor Pro, the paid tier of a page-builder used on millions of sites. The Hacker News first flagged the surge in attack traffic against both plugins.
In plain terms: one gets the attacker in, the other lets them stay.
Who is being hit?
Any site running an unpatched version. Wordfence's telemetry shows automated scanning at scale, meaning bots are sweeping the internet looking for vulnerable installs rather than picking targets. That pattern usually ends with defaced pages, injected spam, cryptominers, or the site being roped into a botnet used for further attacks.
Small businesses are the typical casualty here. Most do not have anyone watching plugin advisories on a Tuesday morning.
What can attackers actually do?
With a successful file upload through the Super Forms bug, an attacker gets what is called remote code execution: the ability to run their own commands on the web server. From there they can read the site's database, steal customer records submitted through contact forms (names, email addresses, phone numbers, sometimes more), plant a backdoor for later, or redirect visitors to scam pages.
| Plugin | CVE | Severity | Flaw |
|---|---|---|---|
| Super Forms | CVE-2026-14894 | 9.8 (Critical) | Unrestricted file upload, no login needed |
| Elementor Pro | Reported by Wordfence | Critical | Remote code execution |
Which regulator cares?
If a compromised site leaks personal data from EU or UK visitors, the site owner, not the plugin maker, is on the hook. That means notifying the Information Commissioner's Office in the UK, or the relevant data protection authority in the EU, within 72 hours of discovery. Australian operators fall under the OAIC's notifiable data breach scheme. US operators face state-level rules and potential FTC scrutiny where customer data was mishandled.
"We recorded a plugin flaw, not a breach notification" is not a defence any of those regulators accept.
What site owners should do now
Log in to your WordPress admin and update both plugins to the latest versions. If you cannot update immediately, deactivate the plugin until you can.
Then check three things: the list of admin users for anyone you do not recognise, the wp-content/uploads folder for files ending in .php, and your site's access logs for repeated POSTs to the plugin's upload endpoint.
If you find any of those, treat it as a breach. Restore from a clean backup, rotate all admin passwords, and work out what personal data was on the site before deciding whether you owe anyone a notification.
