Wordfence Reports Mass Attacks Exploiting Two Unauthenticated WordPress Plugin Flaws

Wordfence has blocked more than 440,000 exploit attempts targeting two WordPress plugin vulnerabilities, one in Super Forms and one in Elementor Pro. The Super Forms flaw can be chained through a built-in endpoint that issues valid nonces to anonymous visitors, enabling code execution with two unauthenticated requests. The Elementor Pro issue exploits a file upload validation weakness that lets PHP files land in a publicly accessible directory, though it requires a page containing a File Upload form field. Both vulnerabilities have been patched in Super Forms 6.3.314 and Elementor Pro 4.2.2, and researchers warn that firewall rules alone do not remove webshells already planted on affected sites.