Two WordPress plugins are under sustained, automated attack, and the volume is hard to wave away. Wordfence has recorded and blocked more than 440,000 exploit attempts against a pair of file-upload flaws, both rated CVSS 9.8, both handing an unauthenticated attacker a path to remote code execution on sites that have not patched. Patchstack has added context on one of them. If you run WordPress for a business in Cyprus or anywhere else, this is a same-day patching item, not a backlog ticket.
What happened
The first target is Super Forms – Drag & Drop Form Builder. The bug, tracked as CVE-2026-14894, is a missing file-type validation check that turns the plugin’s form submission handler into an unauthenticated arbitrary file upload, and from there into code execution. It was fixed in version 6.3.314. Wordfence counts roughly 250,000 attempts against it, with activity starting on 14 July 2026 and peaking on 18 August at more than 40,000 requests in a single day.
The second is Elementor Pro, one of the most widely deployed page builders on the platform. CVE-2026-32475 is also an unauthenticated arbitrary file upload leading to RCE, also scored 9.8, and fixed in version 4.2.2. Around 190,000 attempts have been logged since 19 August 2026. This one has a precondition worth noting: the site needs a published Elementor page that contains a Form widget with a File Upload field. Not every install is exposed, but plenty are.
How the attacks work
Both flaws come down to the same old sin: trusting a file that a stranger sent you. When an upload endpoint fails to check what a file actually is before writing it to disk, an attacker can hand it a script instead of the image or document it expected, then request that script back through the browser to run their own code on the server.
Against Super Forms, the observed campaigns POST to /wp-admin/admin-ajax.php using the super_submit_form action, smuggling base64-encoded PHP dressed up to look like a harmless data:image/gif payload. The end goal is a web shell dropped on the site, seen in the wild under the filename Mushr00w_upl.php. On the Elementor Pro side, uploaded files land in the plugin’s own form directory and keep an attacker-supplied PHP extension:
Super Forms: POST /wp-admin/admin-ajax.php?action=super_submit_form
base64 PHP disguised as data:image/gif
web shell: Mushr00w_upl.php
Elementor Pro: /wp-content/uploads/elementor/forms/
attacker-supplied .php extensionOnce a shell is in place, the site is no longer yours. The attacker can read the database, harvest credentials, pivot to other tenants on shared hosting, plant spam or redirects, and quietly keep access even after you update the plugin. Removing the vulnerable code does not remove a shell that was written while it was still open.
Why it matters
WordPress runs a large share of small and mid-size business sites across Cyprus, from law firms and clinics to hotels and online shops, and most of that footprint is plugin-driven. The two flaws here are attractive to attackers for the same reasons they should worry defenders: no login is required, the payload is cheap to automate, and both plugins are common. Mass scanners do not care who you are. They sweep the whole IPv4 space looking for a vulnerable endpoint, and a peak of 40,000 requests a day against a single flaw is what indiscriminate looks like.
The uncomfortable part is timing. Super Forms attacks began in mid-July and did not peak until mid-August, which means there was a real window where patched code existed but many sites had not applied it. That gap between fix and update is where most WordPress compromises actually happen.
What to do
Patch first, investigate second, and do both today if either plugin is present.
- Update now. Super Forms to
6.3.314or later, Elementor Pro to4.2.2or later. - Assume you may already be hit if you were slow. Scan the filesystem for unexpected or recently modified
.phpfiles, especially inside/wp-content/uploads/, and look specifically for theMushr00w_upl.phpindicator and anything in/wp-content/uploads/elementor/forms/ending in.php. - Review your logs. Check
admin-ajax.phpPOST traffic for thesuper_submit_formaction and for large base64 bodies claiming to be images. - Rotate secrets and rebuild from a known-good backup if you confirm a shell, because a patch alone will not evict an intruder who is already inside.
Patching stops the bleeding, but it does not tell you whether the same class of flaw is hiding in the next plugin you install. That is where a focused review pays for itself. Our WordPress & CMS penetration testing looks at exactly these weak points — insecure file upload, unauthenticated endpoints, and the theme and plugin combinations that expose them — and catches them before the mass scanners do. Full technical write-ups of the two campaigns are available from The Hacker News.
Bottom line
Two critical file-upload flaws, both trivially automatable, both actively exploited at scale. Update Super Forms and Elementor Pro to the fixed versions immediately, hunt for shells if you lagged, and treat every user-facing upload as a question worth testing rather than trusting.