Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Over 440,000 exploit attempts are targeting two critical remote code execution vulnerabilities in WordPress form builder plugins, Wordfence researchers confirmed. The attacks focus on CVE-2024-14894 in Super Forms and a separate critical flaw in Elementor Pro, both exposing WordPress sites to unauthenticated file uploads and code execution.

CVE-2024-14894 carries a CVSS score of 9.8, reflecting near-maximum severity. The vulnerability stems from missing file type validation in Super Forms – Drag & Drop Form Builder. An unauthenticated attacker can upload files of any type through the form submission mechanism, including executable code. This bypasses basic upload restrictions and allows attackers to place malicious PHP files directly on vulnerable servers. Once uploaded, these files execute with the same privileges as the WordPress installation, granting full control over the affected site.

Elementor Pro, used by millions of WordPress sites for page building and form creation, faces its own critical RCE vulnerability. Details remain limited in the initial disclosure, but the attack pattern mirrors Super Forms. The combined threat landscape affects a massive install base. Super Forms alone lists 30,000+ active installations across WordPress.org, while Elementor Pro extends far beyond, powering premium site-building functionality for enterprise and agency clients.

The sheer volume of exploit attempts, exceeding 440,000, demonstrates rapid weaponization. Threat actors typically launch widespread exploitation within hours of vulnerability disclosure when patches lag or fail to deploy. WordPress plugin vulnerabilities spread across distributed attack infrastructure quickly. Wordfence data shows attackers scanning for vulnerable instances at scale, using automated tools to identify sites running outdated plugin versions.

Organizations running either plugin face immediate risk. A successful exploit delivers unauthenticated remote code execution, meaning attackers need no valid login credentials. They gain the ability to install backdoors, exfiltrate sensitive data, inject malware into website content, or pivot to internal networks if the WordPress server sits inside corporate infrastructure. Compromised WordPress sites frequently serve as entry points for ransomware operations and data breaches affecting downstream customers and partners.

The attack surface expands when plugins handle file uploads without strict validation. WordPress developers must enforce whitelist-based file type checking, validate MIME types server-side, and restrict executable permissions on upload directories. Both plugins failed these basic security controls in their vulnerable versions.

Wordfence released initial detection signatures and security advisories alerting administrators. Plugin maintainers released patched versions addressing the validation failures. Super Forms users should update immediately to the patched release. Elementor Pro subscribers must also apply available updates. Site administrators should verify plugin versions in WordPress dashboards, test updates in staging environments first, and enable automatic security updates where possible.

Organizations running multiple WordPress installations should inventory their form builder plugins and prioritize patching. Network-wide deployment tools streamline updates across teams. For sites unable to patch immediately, Web Application Firewalls and ModSecurity rules can block malicious file upload requests matching known exploit patterns. Disabling form functionality temporarily protects against exploitation while updates deploy.

These vulnerabilities underline the ongoing risk in WordPress ecosystem plugins. Each plugin expands the attack surface. Mass-market plugins attract extensive attacker attention precisely because single exploits target hundreds of thousands of sites simultaneously.