Attackers Target Upload Flaws in Two WordPress Form Tools

Many service businesses let customers upload a photo with a quote request. Two popular WordPress form tools had bugs in that exact feature. Attackers are now using them.

The Hacker News reported on September 4, citing security firm Wordfence, that more than 440,000 attack attempts had been blocked against the two plugins.

The Two Plugins

Super Forms, the drag and drop form builder. The bug is tracked as CVE-2026-14894 and rated 9.8 out of 10. The plugin did not check file types. Anyone could upload any file, including a PHP script, without logging in. Version 6.3.314 fixes it.

Elementor Pro. The bug is tracked as CVE-2026-32475. It also allows uploads without a login. It only works on a site with a published page that has a Form widget with a File Upload field. Version 4.2.2 fixes it.

What the Attacks Look Like

Attackers upload PHP files dressed up as images. Once a file is on the server, they can plant a back door, run their own code, add a hidden admin account or steal data.

According to the report, attacks on Super Forms started July 14 and peaked on August 18 with more than 40,000 requests in one day. Wordfence blocked more than 250,000 attempts on that plugin. Attacks on Elementor Pro started August 19, with more than 190,000 attempts blocked.

What to Do Now

• Update Super Forms to 6.3.314 or later.
• Update Elementor Pro to 4.2.2 or later.
• If you do not need file uploads on a form, turn the field off.
• Ask your host or web person to look for PHP files in your uploads folder. Real photos never end in .php.
• Check your list of admin users for accounts you do not know.