Somewhere out there, a botnet is knocking on 440,000 doors and not even bothering to be polite about it. Two wildly popular WordPress plugins just found out that "upload a file" and "upload literally any file including a PHP web shell" are, distressingly, one bug apart.

Two Plugins, One Very Familiar Mistake

Wordfence flagged active, large-scale exploitation of critical flaws in Super Forms (CVE-2026-14894, CVSS 9.8) and Elementor Pro (CVE-2026-32475, CVSS 9.0–9.8), two of the most widely installed plugins in the WordPress ecosystem. Both bugs boil down to missing file-type validation on upload handling — attackers can submit executable PHP files instead of the images or documents the forms expect, no login required.

The Super Forms attacks kicked off back in July and have racked up more than 250,000 blocked attempts, peaking at over 40,000 requests in a single day. Elementor Pro's flaw, patched in version 4.2.2, has drawn 190,000-plus attempts since attackers started probing it in mid-August. Combined, that's north of 440,000 knocks on the same two doors.

A Webshell Is a Terrible Houseguest

Once a PHP file lands in a plugin's upload directory, it's essentially a backdoor with a permanent key — attackers can create new admin accounts, siphon site data, or turn the whole install into a launchpad for further mischief. This isn't a theoretical CVE sitting in a spreadsheet somewhere; it's live, automated, and currently pointed at anyone still running Super Forms below 6.3.314 or Elementor Pro below 4.2.2.

The pattern here is the one that keeps repeating across the CMS world: a plugin ecosystem's greatest strength — anyone can extend anything — is also its favorite attack surface. Patching is table stakes; the sites getting popped are the ones that patched three versions late or never audited what "input validation" actually meant in their upload forms.

If your form plugin accepts uploads and you haven't checked its version number this week, consider this your nudge — the bots already have.

Not sure if your CMS has the same soft spots these plugins did? Our free developer security checklist walks through exactly what to audit before attackers find it for you.

Source: The Hacker News