Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence researchers have identified active exploitation of two critical vulnerabilities in widely used WordPress plugins. CVE-2026-14894, a missing file type validation flaw in Super Forms – Drag & Drop Form Builder, allows unauthenticated attackers to upload files of any type, including web shells. CVE-2026-14895, an unauthenticated admin user creation flaw in Elementor Pro, enables attacker-controlled account proliferation. Exploitation attempts have been detected over 440,000 times, primarily targeting WordPress websites running unpatched versions of these plugins. The flaws pose significant risk of remote code execution, unauthorized administrative access, and complete site takeover. Wordfence and the vendors recommend immediate updating to patched versions to mitigate the risk.