Vulnerabilities & Exploits · Web App Attack

Wordfence sees mass WordPress shell drops

Wordfence says attackers have now launched more than 440,000 exploit attempts against Super Forms and Elementor Pro, turning two WordPress plugin flaws into a mass abuse campaign. The Super Forms issue is CVE-2026-14894, fixed in 6.3.314, and the Elementor Pro issue is CVE-2026-32475, fixed in 4.2.2.

Both bugs let an unauthenticated attacker upload a PHP file as if it were ordinary form content. Once that file lands where the site can serve it, it runs like code, so the next step is often a web shell that can create admin accounts, steal data, and seize the site.

For WordPress sites that expose public file-upload forms, the exposure is no longer a one-off disclosure on a single plugin. Any unpatched instance with the vulnerable form path still reachable is sitting in a live bot-driven takeover window, and cleanup gets harder once a shell has already been planted.

3 sources · Sep 5

CVE-2026-32475

NVD KEV

CVSS 9 CRITICAL: unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious… EPSS 2% (80th percentile).

Timeline

Sources

Sep 5 SecurityWeek
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.
original
Sep 4 The Hacker News
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Attackers are exploiting Super Forms and Elementor Pro flaws to upload PHP files and execute code on WordPress sites.
original
Sep 3 BleepingComputer
Critical Elementor Pro flaw exploited to take over WordPress sites
A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.
original

Part of the PlainSec briefing for 2026-09-03

Every edition of this story: Wordfence sees mass WordPress shell drops

More from today

Vulnerabilities & Exploits · Web App AttackWordfence sees mass WordPress shell dropsWordfence says attackers have now launched more than 440,000 exploit attempts against Super Forms and Elementor Pro, turning two WordPress plugin flaws into a mass abuse campaign. The Super Forms issue is CVE-2026-14894, fixed in 6.3.314, and the Elementor Pro issue is CVE-2026-32475, fixed in 4.2.2.Both bugs let an unauthenticated attacker upload a PHP file as if it were ordinary form content. Once that file lands where the site can serve it, it runs like code, so the next step is often a web shell that can create admin accounts, steal data, and seize the site.For WordPress sites that expose public file-upload forms, the exposure is no longer a one-off disclosure on a single plugin. Any unpatched instance with the vulnerable form path still reachable is sitting in a live bot-driven takeover window, and cleanup gets harder once a shell has already been planted.3 sources · Sep 5

CVE-2026-32475

NVD KEV

CVSS 9 CRITICAL: unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious… EPSS 2% (80th percentile).

Timeline

Sep 5 Reported by SecurityWeek

Sep 4 Reported by The Hacker News

Sep 3 Reported by BleepingComputer

Sources

Sep 5 SecurityWeek

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.

original

Sep 4 The Hacker News

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Attackers are exploiting Super Forms and Elementor Pro flaws to upload PHP files and execute code on WordPress sites.

original

Sep 3 BleepingComputer

Critical Elementor Pro flaw exploited to take over WordPress sites

A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.

original

Part of the PlainSec briefing for 2026-09-03Every edition of this story: Wordfence sees mass WordPress shell dropsMore from today

Citrix NetScaler Gateway flaw hits KEV list

Exchange servers leave mailboxes open to hijack

Plex patch leaves mixed estates exposed