Security researchers have discovered two critical vulnerabilities in WordPress that hackers are actively exploiting in the wild, threatening an estimated tens of millions of websites running the platform.
The flaws allow attackers to achieve remote code execution, granting them full control over compromised sites. This represents a severe risk across WordPress installations, which power roughly 43% of all websites globally. The vulnerabilities were recently patched, but the window between disclosure and widespread exploitation has given threat actors time to launch attacks against unpatched systems.
Cybersecurity researchers documented active exploitation attempts shortly after patches rolled out, indicating organized attack campaigns rather than isolated incidents. Hackers typically scan for vulnerable WordPress installations automatically, making the scale of potential compromise substantial. Site owners who delay patching face immediate risk of complete takeover, data theft, malware injection, and use of their infrastructure for further attacks.
The incident underscores WordPress' persistent challenge as an open-source platform targeting both technical and non-technical users. Many smaller sites and businesses run outdated WordPress versions with disabled auto-updates, leaving them exposed for extended periods. Plugin and theme vulnerabilities compound the problem, as third-party developers vary widely in security practices and patch responsiveness.
WordPress' parent company Automattic has long advocated for automatic security updates, but site administrators retain control over update timing. The gap between patch release and widespread adoption creates a critical vulnerability window that sophisticated attackers exploit methodically.
Enterprise-grade WordPress deployments typically patch within hours or days. Small and medium business sites often lag weeks or months behind. This disparity creates a tiered risk landscape where smaller operators face disproportionate exposure.
Defenders should immediately apply available patches, verify update status across all WordPress installations, and audit sites for signs of compromise. Security plugins offering Web Application Firewall protection can provide temporary mitigation for those unable to patch immediately.