A massive exploit campaign targeting Super Forms and Elementor Pro, two popular WordPress plugins, has been detected, with over 440,000 attempts made in just a few days. The attacks are taking advantage of remote code execution (RCE) vulnerabilities in these plugins, which could allow attackers to inject malicious code into vulnerable websites.
The affected plugins, used by millions of WordPress users worldwide, have become a favorite target for hackers. Super Forms is a plugin that allows website owners to create custom forms and Elementor Pro is a page builder that enables drag-and-drop website design. Both plugins are widely used in the e-commerce sector, where sensitive customer information is often handled.
The RCE flaw in these plugins works by allowing an attacker to inject malicious code into the plugin’s functionality. This can be done through cross-domain privilege escalation, which allows attackers to bypass security restrictions and access sensitive data. The attack typically begins with a user clicking on a phishing link or visiting a compromised website, which then launches the exploit attempt.
The sheer scale of these attacks is alarming, and it’s essential for website owners and administrators to take immediate action to protect their sites. With over 440,000 attempts made in just a few days, it’s clear that this is an organized campaign, and the potential damage could be substantial if left unchecked.
One of the most significant concerns here is that these plugins are used by millions of websites worldwide, many of which may not even be aware of the vulnerabilities. This makes it crucial for website owners to regularly update their plugins and ensure they’re using secure versions of Super Forms and Elementor Pro. Additionally, users should be cautious when clicking on links or visiting unfamiliar websites, as these attacks often begin with a phishing campaign.
As the cybersecurity landscape continues to evolve, it’s essential for users to stay vigilant and take proactive measures to protect themselves. This exploit campaign highlights the importance of keeping software up-to-date and being mindful of potential security threats. By taking these simple steps, website owners can significantly reduce their risk of falling victim to such attacks.
Website administrators should prioritize patching Super Forms and Elementor Pro vulnerabilities as soon as possible. Regularly monitoring plugin versions and updating to secure releases will help prevent these types of exploits from succeeding. Furthermore, users should be cautious when clicking on links or visiting unfamiliar websites, as the phishing campaign that often accompanies these attacks can put them at risk of further compromise.
Source: The Hacker News — 2026-09-04