Home / Technology / Millions of Websites at Risk: Critical Bugs Uncovered in Plugins
Millions of Websites at Risk: Critical Bugs Uncovered in Plugins
7 Sep
Summary
- Two critical vulnerabilities exploited in popular WordPress plugins
- Flaws enable unauthenticated arbitrary file uploads and RCE
- Over 440,000 exploitation attempts detected for these critical bugs
Two critical vulnerabilities have been discovered in popular WordPress plugins, Elementor Pro and Super Forms, potentially affecting over six million websites. Security researchers at Wordfence disclosed these flaws, which enable unauthenticated arbitrary file uploads and subsequent remote code execution.
The first vulnerability, found in Elementor Pro, impacted versions up to and including 4.2.1 and was patched in mid-August 2026. Wordfence blocked over 190,000 attempts to exploit this flaw (CVE-2026-32475).
Concurrently, a similar critical flaw was identified in Super Forms, affecting versions up to and including 6.3.313, and patched recently. This vulnerability (CVE-2026-14894) saw over 250,000 exploitation attempts. Combined, these attacks total more than 440,000, underscoring the significant risk to WordPress users who are strongly advised to apply the updates immediately.
