Technology news and discussion on TalkFuse.
Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk
Hackers are actively exploiting two recently patched, critical security flaws in WordPress, the widely used blogging software that powers a large share of the world's websites. Cybersecurity firms including Patchstack, Hexastrike and WatchTowr have warned that attackers are taking over sites still running vulnerable versions, prompting concern given how severe the bugs are and how many websites remain unpatched despite WordPress issuing forced updates where possible.
The vulnerabilities affect WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1, with official WordPress statistics suggesting over 400 million sites run these flawed versions, though that figure likely doesn't account for sites already patched. Cybersecurity consultant Daniel Card estimated, from a sample of roughly 4,200 sites, that under 15% remain vulnerable, which would still put the total at around 90 million websites at risk; he credited WordPress's automatic updates, Cloudflare's attack-blocking and web firewalls with limiting the damage so far. One of the flaws, dubbed WP2Shell, was discovered by Adam Kues of Searchlight Cyber, and when combined with the second bug allows hackers to seize full remote control of affected sites. WordPress.org and Automattic did not immediately respond to requests for comment.
In short
- Hackers are exploiting two critical WordPress security flaws in the wild
- Tens of millions of sites, possibly around 90 million, remain vulnerable
- Combined bugs let attackers take full remote control of websites
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
These are critical vulnerabilities affecting hundreds of millions of websites, capable of enabling complete remote takeover by attackers. With approximately 90 million sites remaining unpatched and active exploitation now confirmed, the scale and severity demand urgent action from WordPress and site owners to prioritise immediate patching and strengthen security practices. The industry cannot afford complacency when such high-value targets remain exposed to well-organised threat actors.
The case against
Whilst the vulnerabilities are serious, the actual real-world impact appears significantly limited thanks to existing security infrastructure already protecting most websites. Automatic updates, content delivery network protections like Cloudflare, and widespread firewalls have proven effective, with reports indicating that despite weeks of active exploitation, widespread compromise has not materialised. The majority of sites have been patched through automatic mechanisms, suggesting the ecosystem is managing the threat proportionately without requiring panic or extraordinary measures beyond standard security practices.
Explained simply
WordPress is software that powers a large portion of the world's websites, from small blogs to major news sites. When security flaws are discovered in WordPress, they can potentially affect millions of sites at once.
Two critical security flaws have been found in recent versions of WordPress that, when combined, allow attackers to seize complete control of a website. These particular bugs affect WordPress versions from 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.
WordPress has released patches and automatic updates to fix the flaws, but many website owners have not yet installed them. Security experts estimate that tens of millions of websites remain without the fixes.
Cybersecurity Software Technology