If you’re running a WordPress site and haven’t updated it in the past week, now’s the time to check.
Multiple cybersecurity firms, including Patchstack, Hexastrike, and WatchTowr, are warning that hackers are actively exploiting two critical vulnerabilities WordPress patched last week. The flaws are serious enough that WordPress pushed forced automatic updates where it could and urged everyone else to update immediately. That urgency wasn’t for show. Attackers are already taking over sites still running the vulnerable versions, according to all three firms tracking the exploitation.
The affected versions span 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress’s own statistics put more than 400 million sites on those flawed versions, though that number almost certainly overstates the current risk since it doesn’t account for sites that have already patched.
Getting a more realistic estimate takes some digging. Cybersecurity consultant Daniel Card told TechCrunch he sampled roughly 4,200 WordPress sites and found fewer than 15% remained vulnerable. Even at that lower rate, scaling it across the full population of WordPress sites still puts the number of exposed websites somewhere around 90 million, a staggering figure by any measure.
Card credited a few factors with keeping that number from being worse. WordPress’s automatic updates caught a lot of sites before attackers could reach them, Cloudflare has been actively blocking attacks against known-vulnerable sites, and web application firewalls have shielded some of the rest. Automattic and WordPress.org didn’t respond to requests for comment on the situation.
One of the two flaws, nicknamed WP2Shell, came from Adam Kues at cybersecurity firm Searchlight Cyber. Combined with the second vulnerability, the pair gives attackers a path to full remote control over a compromised site, not just partial access, but complete takeover.
For site owners still running an unpatched version, the math is straightforward: tens of millions of sites remain exposed, and the exploitation is already happening in the wild. Updating now, rather than waiting, is the difference between staying ahead of this and becoming part of the statistic.
