Hackers Fire 440,000 Attacks at Two Popular WordPress Plugins
Flaws in Super Forms and Elementor Pro let attackers upload files and run code on unpatched sites, with mass exploitation already underway.
Key points
- Wordfence recorded more than 440,000 exploit attempts against Super Forms and Elementor Pro in recent weeks.
- CVE-2026-14894 in Super Forms lets unauthenticated attackers upload any file type, including code that runs on the server, and carries a critical severity score of 9.8.
- A second critical flaw affects Elementor Pro, the paid version of the widely used page-builder plugin.
- Site owners running either plugin should update immediately and check for unfamiliar files or admin accounts.
- Plugin flaws at this scale hit small businesses hardest, because most have nobody watching security advisories.
Criminals are hammering two popular WordPress add-ons, and the numbers aren't small. Security firm Wordfence has logged more than 440,000 attempts to break into sites running vulnerable versions of Super Forms and Elementor Pro.
Both plugins turn up constantly on small business websites: contact forms, landing pages, online bookings. If your site uses either, this affects you.
What are the flaws?
The more serious bug sits in Super Forms, a drag-and-drop form builder. Tracked as CVE-2026-14894, it scores 9.8 out of 10 on the standard severity scale. The plugin fails to check what kind of file a visitor is uploading, so an attacker who's never logged in can send a PHP file, which is code the web server will run, and take over the site.
Elementor Pro, the paid tier of a page-builder used on millions of sites, carries the second critical flaw. We covered the opening wave of attacks against it on 3 September, when Wordfence had already counted 190,000 attempts in four days alone.
One gets the attacker in; the other lets them stay.
Who is being hit?
Any site running an unpatched version. Wordfence's telemetry shows automated scanning at scale, meaning bots are sweeping the internet for vulnerable installs rather than choosing targets. That pattern typically ends with defaced pages, injected cryptominers, or the site being roped into a botnet for further attacks.
Small businesses are the usual casualty. Most don't have anyone watching plugin advisories on a Tuesday morning.
What can attackers actually do?
A successful file upload through the Super Forms bug gives an attacker what's called remote code execution: the ability to run their own commands on the web server. From there they can read the site's database, steal customer records from contact forms, plant a backdoor for later, or redirect visitors to scam pages.
| Plugin | CVE | Severity | Flaw |
|---|---|---|---|
| Super Forms | CVE-2026-14894 | 9.8 (Critical) | Unrestricted file upload, no login needed |
| Elementor Pro | Reported by Wordfence | Critical | Remote code execution |
Which regulator cares?
If a compromised site leaks personal data from EU or UK visitors, the site owner, not the plugin maker, faces the consequences. That means notifying the Information Commissioner's Office in the UK, or the relevant data protection authority in the EU, within the mandatory reporting window. Australian operators fall under the OAIC's notifiable data breach scheme. US operators face state-level rules and potential FTC scrutiny where customer data was mishandled.
"We recorded a plugin flaw, not a breach notification" isn't a defence any of those regulators accept.
What site owners should do now
Log in to your WordPress admin and update both plugins to the latest versions. If you can't update immediately, deactivate the plugin until you can.
Then check three things: the list of admin users for anyone you don't recognise, the wp-content/uploads folder for files ending in .php, and your site's access logs for repeated POSTs to the plugin's upload endpoint.
Find any of those and treat it as a breach. Restore from a clean backup, rotate all admin passwords, and work out what personal data was on the site before deciding whether you owe anyone a notification.
Should you worry?
If your site's patched, not urgently. If it isn't, yes. WordPress plugin chains like this one don't stay quiet: as our coverage of the BdThemes poisoning in August showed, attackers who find a way in tend to leave something behind for next time.
