# Massive Exploit Campaign Targets WordPress Plugin Vulnerabilities Over 440,000 attack attempts detected on critical security flaws - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-04 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/cdf78b46-cbad-4b3f-87a9-521af746a752 ## Critical WordPress Plugin Vulnerabilities Security researchers have identified two critical vulnerabilities in popular WordPress plugins - Super Forms and Elementor Pro. These flaws allow attackers to upload malicious PHP files and execute arbitrary code on vulnerable websites. The vulnerabilities, tracked as CVE-2026-14894 and CVE-2026-32475, enable complete site takeover, data theft, and creation of admin accounts. Patchstack first disclosed details about CVE-2026-32475 last month, warning about its severity. ## Exploit Attempts Surge Wordfence has reported blocking over 440,000 exploit attempts targeting these vulnerabilities, with 250,000 attempts against CVE-2026-14894 and 190,000 against CVE-2026-32475. Attack activity began on July 14, 2026, peaking at over 40,000 requests on August 18. The attacks originate from multiple IP addresses, indicating a coordinated campaign. Successful exploitation requires specific conditions, including having at least one published Elementor page with a Form widget containing a File Upload field. ## Attack Methodology Attackers exploit the vulnerabilities by sending specially crafted HTTP POST requests to '/wp-admin/admin-ajax.php'. For Super Forms, they use the 'super_submit_form' endpoint with Base64-encoded PHP payloads disguised as image files. The uploaded 'Mushr00w_upl.php' web shell then facilitates additional payload uploads. In Elementor Pro attacks, attackers manipulate file upload fields to bypass validation checks, placing malicious PHP files in '/wp-content/uploads/elementor/forms/' with random names. ## Technical Exploit Details The attack structure involves submitting form file upload fields as arrays where the first element is empty and the second contains the PHP payload. This bypasses security checks. The payloads, while prefixed with 'data:image/gif;base64', are actually PHP scripts. Once uploaded, attackers can directly request these files to execute commands on the server. The malware creates backdoors that persist even after plugin updates, requiring manual removal. ## Impact on WordPress Ecosystem These vulnerabilities affect millions of WordPress sites, as both plugins are widely used for form creation and page building. Elementor Pro alone powers over 12 million websites. The scale of attacks demonstrates how quickly threat actors mobilize when new vulnerabilities emerge. The WordPress security community has been tracking similar file upload vulnerabilities for years, but they remain a persistent threat vector. ## Recommended Mitigations Site administrators should immediately update both plugins to patched versions. They should also scan for indicators of compromise, particularly unexpected PHP files in upload directories. Regular security audits should check for recently modified PHP files. Web application firewalls like Wordfence can help block exploit attempts, but patching remains the most effective defense. Organizations should implement file upload validation at multiple levels. ## Broader Security Implications This incident highlights the risks of third-party plugins in CMS platforms. WordPress's popularity makes it a prime target, with plugins accounting for 56% of all WordPress vulnerabilities in 2025. The attack pattern follows known techniques but achieves significant impact due to the plugins' widespread use. Security teams should monitor not just core software but all extensions, as they often have less rigorous security reviews. ## Future Security Considerations As AI-powered vulnerability discovery accelerates, organizations must strengthen their security postures. This includes implementing continuous monitoring, automated patching systems, and stricter file upload controls. The cybersecurity community predicts more sophisticated attacks leveraging multiple vulnerabilities in 2027. Proactive security measures and rapid response capabilities will become increasingly critical for all web-based platforms. ## Sources covering this story - https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._