Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 CVSS score: 9.8 - A missing file type validation vulnerability in Super Forms – Drag & Drop Form...

CVE-2026-80438

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

MAL-2026-15925 Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

EUVD-2026-70907

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-80438

The Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1 ) contains an improper access control vulnerability in its REST API abilities. The plugin fails to restrict these abilities to administrators, incorrectly treating a plugin-specific capability as equivalent to full site administrati...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-80438 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

WordPress Ninja Forms plugin 3.14.0-3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability

Authenticated Arbitrary Post Modification and Sensitive Information Disclosure vulnerability discovered by ChinhNguyen in WordPress Plugin Ninja Forms versions 3.14.0-3.15.1...

CVE-2025-15691 WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2025-15691

The WPFunnels WordPress plugin, in versions before 3.13.0 , contains an authentication bypass vulnerability. The plugin fails to verify if user registration is enabled on the site before creating accounts from opt-in form submissions, incorrectly relying on a value provided within the request. Th...

CVE-2025-15691 WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2026-80438: Improper Access Control

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

PT-2026-85418

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...

CVE-2026-81773 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

EUVD-2026-70564

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-81773 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-81773

CVE-2026-81773 affects the WordPress Ninja Forms File Uploads Extension plugin in versions 3.3.26 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning no prior authentication is required to exploit it. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of ...

CVE-2026-81773: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...