<![CDATA[🔴 Critical: Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws]]>Threat actors are actively exploiting two critical remote code execution flaws in popular WordPress plugins, Super Forms – Drag & Drop Form Builder and Elementor Pro, according to research from Wordfence. The campaign has generated over 440,000 exploit attempts, indicating a wide-scale, automated effort to compromise vulnerable sites.

The first vulnerability, CVE-2026-14894 (CVSS score: 9.8), is a missing file type validation issue in Super Forms. This flaw allows unauthenticated attackers to upload files of any type, including PHP webshells, which can be leveraged to achieve full remote code execution on the underlying server.

  • The second flaw, related to Elementor Pro, is also actively targeted in these attacks, though specific technical details were not disclosed in the report.
  • The high CVSS score and lack of authentication requirement for the Super Forms flaw make it particularly dangerous for unpatched installations.
  • Site administrators are urged to immediately update both plugins to their latest patched versions to mitigate the risk of compromise.

Indicators of compromise may include unexpected file uploads in wp-content/uploads directories, particularly .php files, and suspicious admin user creation events. Monitor access logs for abnormal POST requests to form handlers as a precautionary measure.

Source: The Hacker News

Are any of your managed WordPress sites running these plugins, and have you seen any malicious file upload activity in your logs yet?

]]>https://xploitlk.com/topic/212/critical-over-440-000-exploit-attempts-target-super-forms-and-elementor-pro-rce-flawsRSS for NodeSat, 05 Sep 2026 12:37:43 GMTFri, 04 Sep 2026 10:30:23 GMT60