Wordfence disclosed two critical file-upload vulnerabilities affecting Elementor Pro and Super Forms on September 7, reporting more than 440,000 combined exploitation attempts targeting the flaws since mid-August patches were released, according to TechRadar. Both vulnerabilities carry 9.8/10 severity ratings and enable unauthenticated remote code execution on WordPress installations running unpatched versions.
TL;DR: Wordfence researchers disclosed CVE-2026-32475 in Elementor Pro (6M+ sites) and CVE-2026-14894 in Super Forms (13,000+ sites) on September 7, with 440,000+ exploitation attempts observed since mid-August patches shipped.
Elementor Pro, a commercial drag-and-drop page builder deployed on more than six million WordPress websites, contained an unrestricted file-type upload flaw tracked as CVE-2026-32475 in all versions through 4.2.1. The vulnerability permits unauthenticated attackers to upload executable files when a published page contains an Elementor Pro Form widget with at least one non-required File Upload field, Wordfence researchers explained. Wordfence threat intelligence systems blocked more than 190,000 exploit attempts targeting the Elementor flaw.
Super Forms, a form-builder plugin with approximately 13,000 active installations, shipped with a parallel arbitrary file-upload vulnerability designated CVE-2026-14894 affecting all versions through 6.3.313. The flaw similarly enables unauthenticated remote code execution through file uploads. Wordfence observed more than 250,000 exploitation attempts against Super Forms installations.
Active Exploitation Timeline
Both vulnerabilities were patched in mid-August 2026, yet exploitation attempts continue at scale. The WordPress Plugin Exploits Launch Within Hours pattern observed in prior disclosures appears to be accelerating—attackers began targeting both flaws immediately following patch availability, indicating either reverse-engineering of the security updates or prior knowledge of the vulnerabilities.
Wordfence characterized both flaws as "unrestricted file type upload" vulnerabilities that bypass file-validation controls. "This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible," the security firm stated in its disclosure.
Patch Deployment Status
Elementor Ltd. shipped version 4.2.2 in mid-August addressing CVE-2026-32475. Super Forms released version 6.3.314 during the same window patching CVE-2026-14894. Neither vendor has publicly disclosed whether the vulnerabilities were identified through internal audits, external researcher submissions, or incident response to active exploitation.
The six million Elementor Pro installation base represents roughly 8 percent of the estimated 75 million live WordPress websites tracked by BuiltWith. Super Forms' 13,000 installations constitute a smaller surface area but share the identical 9.8/10 severity rating, indicating comparable risk for affected sites.
Required Site Conditions for Exploitation
The Elementor Pro vulnerability requires specific site configurations to be exploitable. A published page must include an Elementor Pro Form widget containing at least one File Upload field configured without the "required" attribute. Sites that do not publish Elementor forms or enforce field-level requirements on all file-upload inputs remain unexploitable through this vector.
Super Forms installations appear vulnerable without conditional requirements beyond the presence of the plugin itself, based on Wordfence's disclosure language. The firm did not specify configuration dependencies for CVE-2026-14894 exploitation.
Both flaws follow the WordPress Core Security Initiative pattern of unauthenticated file-upload bypasses that have dominated WordPress security disclosures through 2026. The initiative, launched September 1, targets acceleration of vulnerability detection ahead of AI-enabled exploit development.
Agencies Implications
Digital agencies managing WordPress client sites must prioritize immediate patching of Elementor Pro installations to version 4.2.2 or later and Super Forms to 6.3.314 or later. The combined 440,000 exploitation attempts observed by a single security vendor suggest total attempt volumes across the broader threat landscape exceed that figure by an order of magnitude—agencies should assume active scanning is targeting their managed installations.
For Elementor Pro sites, agencies can partially mitigate exposure by auditing published pages for Elementor Pro Form widgets and temporarily removing File Upload fields until patches deploy. This remediation step does not eliminate the vulnerability but reduces the exploitable attack surface while update workflows complete. Agencies maintaining staging environments should test the Elementor 4.2.2 update for widget compatibility before production deployment, as major-version plugin updates occasionally introduce layout regressions.
Client communication protocols should include specific disclosure of the CVE identifiers, the RCE risk classification, and confirmation of patch deployment dates. The 9.8/10 severity rating places both vulnerabilities in the "critical" tier that triggers breach notification review under cyber insurance policies—agencies should document remediation timelines for any clients operating under compliance frameworks or breach-notification statutes. For high-value client properties still running vulnerable versions, agencies may need to consider temporary firewall rules blocking file-upload POST requests to Elementor and Super Forms endpoints while coordinating maintenance windows for updates.