Wordfence blocks 440,000 attacks on WordPress plugin RCE flaws

Wordfence has blocked over 440,000 exploit attempts against two WordPress plugin vulnerabilities. Critical CVE-2026-14894 (9.8) in Super Forms allows unauthenticated code execution in two requests: one mints a nonce, the second uploads a PHP webshell. Fixed in Super Forms 6.3.314 and Elementor Pro 4.2.2.

• CVE-2026-14894 in Super Forms: unauthenticated RCE rated 9.8
• Two-request chain: super_create_nonce mints a nonce, then a PHP webshell is uploaded
• CVE-2026-32475 in Elementor Pro bypassed via array with .php in second element
• Patches: Super Forms 6.3.314 and Elementor Pro 4.2.2