WordPress Plugin Flaws Draw 440,000 Exploit Attempts

Wordfence Tracks 440,000+ Attacks on a Critical WordPress Form Plugin

Attackers have launched more than 440,000 exploit attempts against a critical vulnerability in the Super Forms, Drag & Drop Form Builder plugin for WordPress, according to findings published by Wordfence on September 4, 2026. Wordfence is a WordPress-focused security company that operates a web application firewall and a threat intelligence feed used across millions of WordPress sites. The flaw, tracked as CVE-2026-14894 and rated 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), stems from missing file type validation that lets an unauthenticated attacker upload files of any type to a vulnerable site, including executable code.

Wordfence's reporting also links a second critical flaw in Elementor Pro, a widely used premium page-builder plugin for WordPress, to the same wave of scanning and exploitation activity. A CVE identifier and technical details for the Elementor Pro issue were not included in the available reporting at publication time, so site owners should treat both plugins as high priority for review until the vendors publish full advisories.

Why an Unauthenticated File Upload Flaw Rates a 9.8

A CVSS score of 9.8 sits near the top of the 0 to 10 scale that security teams use to gauge how easily a vulnerability can be exploited and how much damage it can cause. The "unauthenticated" label is the critical detail here: an attacker does not need a login, an account, or any prior access to the site to exploit CVE-2026-14894. They only need to find a public-facing Super Forms installation.

Missing file type validation means the plugin does not properly confirm whether an uploaded file is a harmless image or document versus a script the web server will execute. When that check is absent, an attacker can upload a web shell, a small script disguised as an ordinary file, and then call it directly to run commands on the server. That single step can lead to remote code execution (RCE), the ability to run arbitrary commands on the host as if the attacker had direct server access. From there, an attacker can plant backdoors, pivot to other sites on shared hosting, harvest data stored in the WordPress database, or use the compromised server to launch further attacks.

According to Wordfence's telemetry cited in this report, over 440,000 exploit attempts against this flaw have already been recorded, which indicates automated tools are actively scanning the internet for vulnerable Super Forms installations rather than this being a narrowly targeted campaign.

What WordPress Site Owners Should Do This Week

Mass scanning campaigns like this one move fast: automated tools test hundreds of thousands of sites for a known flaw within days of disclosure, and any site still running a vulnerable plugin version becomes a target regardless of its size or industry. Healthcare practices, tax and accounting firms, and small businesses using WordPress for patient portals, client intake forms, or general marketing sites are all in scope if they use either plugin.

• Update immediately. Log into your WordPress admin dashboard, check the installed version of Super Forms and Elementor Pro, and apply the latest update offered by the plugin developer. If no patched version is yet available for your installed version, deactivate the plugin until one is released.
• Check for signs of compromise. Review your uploads directory and any custom form-submission folders for unfamiliar files, particularly ones with.php extensions disguised as images or documents. Compare current file listings against a recent clean backup if you have one.
• Deploy a web application firewall (WAF). A WAF rule set that blocks known exploit patterns for these CVEs can reduce exposure while you confirm patch status across your site inventory.
• Restrict file upload execution. Configure your web server or hosting control panel so the uploads directory cannot execute PHP or other scripts, regardless of what a vulnerable plugin allows through.
• Audit admin accounts and credentials. If you find evidence of a successful upload, rotate WordPress admin passwords, database credentials, and any API keys stored on the site, since a compromised server can expose all of them.
• Maintain offline backups. A backup stored outside the web server, taken before any suspected compromise, is the fastest path to recovery if remediation requires a full site rebuild.

What to Watch Next

Expect Wordfence and other WordPress security vendors to publish updated indicators of compromise and firewall rules as exploitation continues; check the Wordfence vulnerability database for the latest status on CVE-2026-14894 and any identifier assigned to the Elementor Pro flaw. Site owners should also monitor the plugin's official listing on WordPress.org for changelog entries confirming a security fix, since vendors do not always flag security patches clearly in release notes. Given the scale of scanning already observed, sites that delay patching for even a few days face meaningfully higher odds of compromise than sites that update this week.