Wordfence has reported a significant volume of exploit attempts targeting two distinct critical remote code execution (RCE) vulnerabilities in popular WordPress plugins: Super Forms and Elementor Pro. Over 440,000 exploit attempts have been observed, indicating widespread malicious activity aimed at leveraging these flaws.
One of the vulnerabilities, identified as CVE-2026-14894 with a CVSS score of 9.8, affects the Super Forms – Drag & Drop Form Builder plugin. This flaw is described as a missing file type validation vulnerability. It allows unauthenticated attackers to upload arbitrary file types to affected WordPress installations.
The technical mechanism behind CVE-2026-14894 typically involves a web application failing to properly sanitize or validate user-supplied input, specifically regarding file uploads. In this case, the absence of file type validation means an attacker can bypass restrictions designed to only permit safe file types (like images or documents) and instead upload malicious scripts, such as PHP files. Once uploaded, if the web server is configured to execute these files, the attacker can achieve remote code execution, gaining control over the compromised server.
Products in the category of WordPress form builders and page builders are frequently targeted due to their widespread use and their common inclusion of file upload functionalities. The potential scope of impact for such vulnerabilities is broad, encompassing any website running the vulnerable versions of Super Forms. Attackers often scan for specific plugin fingerprints to identify vulnerable targets at scale.
Mitigation for this class of issue typically involves several steps. Website administrators should immediately update the Super Forms plugin to the latest patched version. If an update is not yet available, disabling the plugin or implementing web application firewall (WAF) rules to block suspicious upload requests can provide temporary protection. Regular security audits and ensuring all WordPress core, themes, and plugins are kept up-to-date are fundamental best practices.
The second vulnerability, affecting Elementor Pro, is also described as an RCE flaw, though specific details beyond its existence were not provided in the summary. Elementor Pro is another widely used WordPress plugin, and an RCE vulnerability in such a popular tool presents a similar high risk.
The high volume of exploit attempts underscores the persistent threat posed by vulnerabilities in widely used content management system plugins. Attackers consistently target popular platforms like WordPress, knowing that a single vulnerability can open doors to hundreds of thousands of potential victims. This incident highlights the critical importance of timely patching and robust security practices for all website administrators.
