Wordfence Blocks 440,000+ Attempts on Super Forms and Elementor Pro RCE CVEs
Two critical arbitrary file upload flaws in widely deployed WordPress plugins triggered 440,000+ exploit attempts within weeks. Evidence from firewall logs and payload analysis shows direct path to site takeover via web shells. Timely patching remains the only effective control against this recurring attack pattern.
Attackers targeted unauthenticated file upload flaws allowing arbitrary PHP execution. Super Forms version before 6.3.314 and Elementor Pro before 4.2.2 permitted Base64-encoded payloads via admin-ajax.php and form widgets. Wordfence telemetry shows peaks exceeding 40,000 daily requests on 18 August, originating from ten IPs including 103.168.147.235 and 64.176.209.104. The Mushr00w_upl.php shell then staged further uploads. Procurement records and plugin update logs reveal both vendors shipped fixes weeks after initial disclosure, yet active sites remain exposed. Technical indicators match prior WordPress plugin campaigns where missing MIME validation enabled rapid weaponization. Independent telemetry from Patchstack on CVE-2026-32475 aligns with Wordfence counts, confirming the scale. Official vendor statements emphasize patching while understating persistence of unpatched instances in production. Contract and changelog data show repeated delays between advisory and release, a pattern across multiple popular plugins. Sites running published Elementor forms with upload fields face highest risk. Expect continued scanning from the same infrastructure until patch adoption exceeds 80 percent. Administrators should audit file upload handlers and monitor for anomalous POSTs to admin-ajax.php.
Wordfence: Unpatched sites will receive at least 75,000 additional targeted requests by 30 September 2026.
Sources (2)
- [1]Wordfence Intelligence Report(https://www.wordfence.com/blog/2026/09/super-forms-elementor-pro-exploits/)
- [2]The Hacker News Coverage(https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html)