Over 440,000 attacks hit unauthenticated RCE in WordPress Super Forms and Elementor Pro

What happened

Wordfence, the WordPress security firm, has blocked more than 440,000 exploit attempts against a pair of remote code execution vulnerabilities in widely used WordPress plugins, according to a write-up on dev.to by security researcher Jason Miller. The more severe of the two, in the Super Forms plugin, demands nothing from the attacker: no account, no stolen session, no scraped nonce. Two unauthenticated HTTP requests are enough to gain code execution.

The campaign is notable for both its scale and its opportunism. Wordfence recorded attacks against both plugins running in parallel from roughly ten source IPs each, peaking at about 40,000 requests in a single day against Super Forms alone. Miller's read is that nobody is picking specific targets — every host running the affected plugins is a candidate.

Two requests, one webshell

The Super Forms flaw, tracked as CVE-2026-14894 with a CVSS score of 9.8, sits in the plugin's submit_form AJAX handler, which Miller reports performs no file-type validation and verifies no user capabilities.

A missing nonce check normally slows attackers down, because valid nonces have to be lifted from rendered pages. But Super Forms also ships a second unauthenticated AJAX action, super_create_nonce, which issues a valid nonce and session cookie to any anonymous visitor on demand.

The resulting chain is minimal: the first request mints the nonce, and the second POSTs to admin-ajax.php carrying a Base64-encoded PHP payload disguised with a data:image/gif;base64 prefix and an attacker-chosen .php filename. The payload observed in the wild, Mushr00w_upl.php, is an uploader webshell used to run commands and to create fresh administrator accounts. The flaw is fixed in Super Forms 6.3.314.

The Elementor Pro upload bypass

The second vulnerability, CVE-2026-32475 in Elementor Pro, is a parser trick rather than a missing check. Submitting the File Upload field as an array — an empty first element with the PHP payload in the second — lets the payload slip past validation and land in /wp-content/uploads/elementor/forms/, where it can be requested directly.

There is one precondition: the site must have a published page containing a Form widget with a File Upload field. Miller says this likely explains why the flaw is scored 9.0 in some places and 9.8 in others, and he cautions against treating the precondition as protection. Upload fields are common in contact and quote forms, so an unpatched site becomes exploitable the moment an editor adds one. The fix ships in Elementor Pro 4.2.2.

Patch first, then hunt

The write-up is emphatic about ordering: patch to stop new uploads first, then hunt for compromise, because a webshell planted before the patch survives the update.

Miller's recommended checks include searching access logs for the super_create_nonce action and for .php files under the Elementor forms upload directory, and scanning wp-content/uploads for any PHP, .phtml or .phar files, none of which belong there. He also advises listing administrator accounts and questioning any unfamiliar ones, since rogue admin creation was part of the observed post-exploitation behaviour. Where a shell is found, the guidance is to isolate the host, restore from a backup predating the first suspicious log entry, and rotate every credential on the machine.

One further caveat involves Wordfence's own firewall. New rules reach premium customers first, with the free tier following roughly 30 days later, so free-tier users had no rule during the campaign's peak. Even a working rule does nothing about a shell dropped before it existed. The WAF buys patch time; the update is the fix.

Why it matters

Unauthenticated remote code execution in a popular plugin is about as bad as WordPress exposure gets, and this one collapses the usual barriers entirely. The volume already recorded points to mass exploitation, and Miller argues that turning a write-up this simple into a working scanner is trivial. Site owners running either plugin should treat same-day patching as the default, audit their Elementor pages for File Upload fields to understand their exposure before an editor adds one, and remember that a firewall block is not the same thing as a clean site.