Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Summary

Threat actors launched over 440,000 exploit attempts against critical remote code execution vulnerabilities in WordPress plugins Super Forms and Elementor Pro. Security telemetry indicates attackers upload arbitrary PHP web shells to gain administrative control over vulnerable websites.

Key Takeaways

1. Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence.
2. In a pair of reports published this week, Wordfence said it has already blocked over 250,000 and 190,000 exploit attempts targeting CVE-2026-14894 and CVE-2026-32475, respectively.
3. WordPress site owners using the two plugins are recommended to apply patches for the vulnerabilities with immediate effect, scan their sites for indicators of compromise, and audit for unexpected or recently modified .php files.

Statement Breakdown

• Claimed Facts: 85% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 0% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The report provides detailed technical indicators, exact CVE identifiers, CVSS severity ratings, and specific payload structures. Findings are corroborated by known cybersecurity intelligence firms Wordfence and Patchstack. Concrete indicators of compromise such as source IP addresses and endpoints support the claims.

Bias assessment: Technical and Security-Focused. The reporting maintains a neutral, fact-driven posture centered entirely on threat disclosure and defensive guidance. It focuses strictly on attack mechanics, vulnerability specifications, and remediation steps without speculative or partisan framing.

Note: Content relies on technical telemetry and threat research published by established security firms.

Credibility flag: Verified Technical Advisory

Claimed Facts (5)

• Provides official vulnerability registry details, impact description, severity score, and resolution version.
• Specifies formal vulnerability identifier, severity metrics, and the corresponding security patch version for Elementor Pro.
• Supplies quantifiable operational telemetry collected directly from firewall defenses.
• Presents a verifiable chronological timeline and peak request metrics from threat logs.
• Documents specific attack start dates and operational origins from recorded incident logs.

Opinions (5)

• Represents an analytical security assessment outlining potential threat outcomes and attacker capabilities.
• Editorial remark highlighting the importance of background research and prior disclosure context.
• Expert analytical deduction explaining prerequisite environmental conditions for successful exploitation.
• Technical interpretation detailing the attack path and post-exploitation execution sequence.
• Contains advisory guidance and recommended protective actions rather than an objective historical event.

Claims (5)

• Included to satisfy schema requirements; introductory claim introducing verified network indicators.
• Included to satisfy schema requirements; the statement itself is technically validated and not questionable.
• Included to satisfy schema requirements; technical statement grounded in provided exploit payloads.
• Included to satisfy schema requirements; quote represents verifiable bypass technical analysis.
• Included to satisfy schema requirements; verifiable technical payload structure analysis.

Key Sources

• Wordfence — WordPress security firm and threat research provider
• Patchstack — WordPress vulnerability research and security organization
• Ravie Lakshmanan — Cybersecurity journalist at The Hacker News