Mass scanning of Super Forms/Elementor Pro upload endpoints

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•1

This rule detects high-volume, potentially automated POST requests to specific WordPress plugin endpoints (Super Forms and Elementor Pro) used for form submissions and file uploads. A high frequency of these requests from a single source within a short timeframe suggests active reconnaissance or exploitation attempts against these vulnerable components.