Two major security flaws are affecting more than six million WordPress websites

Security researchers at Wordfence have disclosed two critical vulnerabilities affecting popular WordPress plugins, Elementor Pro and Super Forms. Both flaws, identified as CVE-2026-32475 and CVE-2026-14894, carry a severity score of 9.8/10 and allow unauthenticated attackers to perform arbitrary file uploads, potentially leading to remote code execution. Elementor Pro, which powers over six million websites, and the Super Forms plugin have both been patched in recent updates. However, the situation remains urgent as researchers have already observed over 440,000 exploitation attempts in the wild. The vulnerabilities stem from unrestricted file type uploads, enabling malicious actors to compromise websites. Given the widespread use of these plugins, security experts strongly advise all administrators to verify their plugin versions and apply the latest security patches immediately to prevent potential website takeovers and further malicious activity.