The Super Forms request is one HTTP POST to /wp-admin/admin-ajax.php against the super_submit_form endpoint, with the file field carrying a base64 payload and an attacker-chosen filename [5]. The blob is prefixed data:image/gif;base64 and decodes to PHP, because the plugin does not check the type before writing [1][6]. What lands is Mushr00w_upl.php, a web shell whose function is to accept further uploads [6]. Eviction order follows from that: deleting the first file achieves nothing if a second stage went in behind it. The sampled request also carries form_id=2 and an sf_nonce value, which makes it cheap to grep in access logs [18].
Elementor Pro fails differently. The File Upload field is submitted as an array, empty first element and PHP payload second, and Wordfence says that structure is what triggers the validation bypass [10]. The file is written to /wp-content/uploads/elementor/forms/ under a randomly generated name with the attacker's .php extension, then requested directly [11]. Two hunt targets, then: .php files in that directory, and admin-ajax.php POSTs containing super_submit_form.
The two block counts add to more than 440,000 [4], and they are what the label says, attempts Wordfence stopped on sites it protects [3]. The reporting carries no figure for successful compromises and no release date for either patch [17]. High volume tells you the scanning is industrialised, not how many shells are resident.
Elementor Pro exploitation opens on August 19, 2026 [8], one day after the Super Forms activity peaked [9], against a bug Patchstack had documented the month before [13]. The primitive is identical in both campaigns: unauthenticated write of a PHP file into a path the web server executes. The attention moves to whichever plugin was most recently written up.
Configuration decides the Elementor half of the triage. A site below 4.2.2 is only exploitable if it has at least one published page with a Form widget containing a File Upload field [12]. No equivalent precondition is stated for Super Forms [16], where an active plugin is the whole requirement. A version report therefore ranks the Elementor estate badly, and a page inventory ranks it properly.
CVE-2026-32475 is scored 9.0 in one place and 9.8 in another [2]. The spread has no operational content: unauthenticated file write into an executable directory sits at the front of the queue on either number.
Wordfence lists ten source IPs on the Super Forms side [15]. Blocking them is housekeeping. The reachable outcome for any hit that got through is an administrator account and control of the site, with the database in between [14].
