As reported by The Hacker News, Wordfence has documented over 440,000 exploit attempts targeting two critical WordPress plugin vulnerabilities since their disclosure. This represents one of the most aggressive mass-exploitation campaigns against WordPress plugins in 2026, and the speed at which threat actors weaponized these flaws underscores a persistent structural weakness in the WordPress ecosystem: the sheer attack surface created by millions of sites running third-party plugins with inconsistent security postures.

Security Impact: As reported by The Hacker News, Wordfence has documented over 440,000 exploit attempts targeting two critical WordPress plugin vulnerabilities since their disclosure.

Vulnerability Summary

CVECVSSAffected ProductPatched VersionActive Exploitation
CVE-2026-148949.8 (Critical)Super Forms – Drag & Drop Form Builder6.3.314Yes — 250,000+ attempts blocked
CVE-2026-324759.0–9.8 (Critical)Elementor Pro4.2.2Yes — 190,000+ attempts blocked

Both flaws stem from the same fundamental design failure: missing server-side file type validation on upload endpoints. The result is unauthenticated remote code execution — the most severe outcome possible for a web application vulnerability. An attacker needs no credentials, no valid session, and no user interaction. A single crafted HTTP POST request is sufficient to deposit a PHP web shell on the target server.

Why This Matters Beyond the Patch

The technical mechanism here is not novel. Arbitrary file upload vulnerabilities have been a known class for over a decade. What makes this campaign significant is the convergence of three factors:
Vulnerability Summary
Mass attack velocity: 440,000+ attempts in a compressed timeframe indicates automated, internet-wide scanning and exploitation — likely botnet-driven or using distributed infrastructure.
Plugin ubiquity: Elementor Pro powers a substantial portion of the WordPress site ecosystem. Super Forms, while less widely deployed, is common on business and marketing sites that collect user data.
Pre-auth chain potential: Once a web shell is planted, attackers routinely pivot to credential theft, database exfiltration, defacement, or deployment of cryptocurrency miners and ransomware payloads. WordPress sites are frequently used as staging infrastructure for phishing and malware distribution.

The Elementor Pro flaw requires a specific configuration to be exploitable: at least one published page containing a Form widget with a File Upload field. This conditional requirement means not every Elementor Pro installation is vulnerable — but sites that do expose file upload functionality are squarely in the crosshairs.

Who Is Most Exposed

Small-to-medium businesses represent the highest-risk population. These organizations typically manage WordPress sites with limited security oversight, delayed update cycles, and no dedicated web application firewall. Hosting providers offering shared WordPress environments should be particularly concerned, as a compromised site on shared infrastructure can potentially affect neighboring tenants depending on server configuration.

Additionally, any organization using these plugins on sites that process sensitive form submissions — PII, financial data, healthcare intake — faces compounded risk. A web shell gives attackers direct access to form submission data and the underlying database.

Shield53 Recommendations

Immediate Actions

  • Patch both plugins immediately: Update Super Forms to version 6.3.314 or later. Update Elementor Pro to version 4.2.2 or later. Verify the update applied successfully by checking plugin version numbers in the WordPress admin dashboard.
  • Audit for web shells: Scan the WordPress installation directory, particularly /wp-content/uploads/ and any form-specific upload paths, for unexpected .php files. Look for files with random names, recent modification timestamps, or obfuscated Base64 content.
  • Review access logs: Search web server access logs for POST requests to /wp-admin/admin-ajax.php containing super_submit_form or Elementor form-related action parameters. Flag any requests with Base64-encoded file payloads.
  • Disable file uploads if not needed: If your forms do not require file upload functionality, remove the File Upload field from all Elementor Form widgets and Super Forms configurations. This eliminates the attack vector entirely for the Elementor Pro flaw.
  • Restrict PHP execution in upload directories: Configure your web server to deny PHP execution within /wp-content/uploads/ and any writable directories. This is a critical defense-in-depth measure that prevents uploaded web shells from executing even if file validation fails.

Strategic Hardening

  • Implement a Web Application Firewall (WAF) with virtual patching capability — Wordfence, Sucuri, or Cloudflare WAF can block exploit attempts before they reach the application layer.
  • Enforce automatic plugin updates for critical security releases, or subscribe to vulnerability feeds for monitored patch deployment.
  • Conduct regular file integrity monitoring (FIM) on WordPress installations to detect unauthorized file additions or modifications.
  • For managed hosting providers: isolate WordPress tenants using PHP-FPM pool separation and disable dangerous PHP functions (exec, shell_exec, system, passthru) where possible.

The broader lesson is familiar but bears repeating: the WordPress plugin ecosystem remains a soft target because security validation at the plugin level is inconsistent and enforcement is largely reactive. Organizations running WordPress at scale should treat every plugin as an untrusted code extension and apply the same vendor risk management principles they would use for any third-party software dependency.