Massive Scan Flood Targets WordPress Plugins After Critical Flaws Discovered

Security researchers have recorded more than 440,000 automated attempts to exploit two newly disclosed vulnerabilities in popular WordPress plugins, underscoring the rapid pace at which threat actors move against unpatched software.

The flaws affect Super Forms and Elementor Pro, two widely used extensions that add advanced form‑building and page‑design capabilities to WordPress sites. In Super Forms, a missing file‑type validation check (identified as CVE‑2026‑14894) grants attackers the ability to upload malicious files and execute code on the server, earning it a maximum CVSS rating of 9.8. Elementor Pro suffers a separate remote code execution weakness that similarly enables unauthenticated users to run arbitrary commands.

Wordfence, a leading WordPress security platform, first flagged the surge of exploit attempts after its firewall logged a spike in suspicious requests targeting the vulnerable endpoints. The company’s data shows that the attacks are largely automated, with bots probing thousands of sites per hour to locate installations that have not yet applied the patches released by the plugin authors.

WordPress powers roughly 43% of all websites, and its extensible architecture encourages the use of third‑party plugins to add functionality. While this flexibility fuels innovation, it also expands the attack surface; a single vulnerable add‑on can compromise an entire site. The sheer volume of attempts observed suggests that malicious actors are treating the disclosed flaws as high‑value targets, likely because successful exploitation can give them full control over a compromised server.

Both plugin developers responded quickly, publishing security updates that address the validation and code‑execution gaps. They have urged site administrators to upgrade to the latest versions immediately and to review any custom code that might bypass the new checks. Security experts also recommend enabling a web‑application firewall, restricting file uploads to trusted types, and conducting regular vulnerability scans.

Looking ahead, researchers expect the exploitation attempts to continue until the majority of WordPress installations adopt the fixes. The episode highlights the ongoing need for vigilant maintenance in the open‑source ecosystem, where rapid patch deployment and proactive monitoring remain the most effective defenses against opportunistic attacks.