{"id":10258,"date":"2026-07-20T12:55:21","date_gmt":"2026-07-20T16:55:21","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10258"},"modified":"2026-07-20T12:16:41","modified_gmt":"2026-07-20T16:16:41","slug":"millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/","title":{"rendered":"Millions of WordPress sites face active attacks after critical bug found"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">If you&#8217;re running a <a href=\"https:\/\/wordpress.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">WordPress<\/a> site and haven&#8217;t updated it in the past week, now&#8217;s the time to check.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">Multiple cybersecurity firms, including <a href=\"https:\/\/hostingdiscussion.com\/news\/patchstack-case-study-exposes-gaps-in-wordpress-security-where-hosting-defenses-fall-short\/\">Patchstack<\/a>, Hexastrike, and WatchTowr, are warning that hackers are actively exploiting two critical vulnerabilities WordPress patched last week. The flaws are serious enough that WordPress pushed forced automatic updates where it could and urged everyone else to update immediately. That urgency wasn&#8217;t for show. Attackers are already taking over sites still running the vulnerable versions, according to all three firms tracking the exploitation.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">The affected versions span 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress&#8217;s own statistics put more than 400 million sites on those flawed versions, though that number almost certainly overstates the current risk since it doesn&#8217;t account for sites that have already patched.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">Getting a more realistic estimate takes some digging. Cybersecurity consultant Daniel Card told TechCrunch he sampled roughly 4,200 WordPress sites and found fewer than 15% remained vulnerable. Even at that lower rate, scaling it across the full population of <a href=\"https:\/\/hostingdiscussion.com\/news\/wordpress-hosting-market-gains-momentum-as-businesses-seek-faster-safer-sites\/\">WordPress sites<\/a> still puts the number of exposed websites somewhere around 90 million, a staggering figure by any measure.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">Card credited a few factors with keeping that number from being worse. WordPress&#8217;s automatic updates caught a lot of sites before attackers could reach them, <a href=\"https:\/\/hostingdiscussion.com\/news\/cloudflare-scans-200000-websites-and-finds-ai-agents-can-barely-use-any-of-them\/\">Cloudflare<\/a> has been actively blocking attacks against known-vulnerable sites, and web application firewalls have shielded some of the rest. <a href=\"https:\/\/hostingdiscussion.com\/news\/automattic-internet-archive-work-to-curb-link-rot-across-wordpress-sites\/\">Automattic<\/a> and WordPress.org didn&#8217;t respond to requests for comment on the situation.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">One of the two flaws, nicknamed WP2Shell, came from Adam Kues at cybersecurity firm Searchlight Cyber. Combined with the second vulnerability, the pair gives attackers a path to full remote control over a compromised site, not just partial access, but complete takeover.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"auto\">For site owners still running an unpatched version, the math is straightforward: tens of millions of sites remain exposed, and the exploitation is already happening in the wild. Updating now, rather than waiting, is the difference between staying ahead of this and becoming part of the statistic.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re running a WordPress site and haven&#8217;t updated it in the past week, now&#8217;s the time to check. Multiple cybersecurity firms, including Patchstack, Hexastrike, and WatchTowr, are warning that hackers are actively exploiting two critical vulnerabilities WordPress patched last week. The flaws are serious enough that WordPress pushed forced automatic updates where it could [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[7440,7437,7439,12,7441,7438],"class_list":["post-10258","post","type-post","status-publish","format-standard","hentry","category-featured","tag-critical-cms-patch","tag-security-vulnerability","tag-website-hacking","tag-wordpress","tag-wordpress-update-urgent","tag-wp2shell-exploit"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Millions of WordPress sites face active attacks after critical bug found - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Millions of WordPress sites face active attacks after critical bug found - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"If you&#8217;re running a WordPress site and haven&#8217;t updated it in the past week, now&#8217;s the time to check. Multiple cybersecurity firms, including Patchstack, Hexastrike, and WatchTowr, are warning that hackers are actively exploiting two critical vulnerabilities WordPress patched last week. The flaws are serious enough that WordPress pushed forced automatic updates where it could [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-20T16:55:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-20T16:16:41+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/\",\"name\":\"Millions of WordPress sites face active attacks after critical bug found - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-07-20T16:55:21+00:00\",\"dateModified\":\"2026-07-20T16:16:41+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Millions of WordPress sites face active attacks after critical bug found\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Millions of WordPress sites face active attacks after critical bug found - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/","og_locale":"en_US","og_type":"article","og_title":"Millions of WordPress sites face active attacks after critical bug found - Web Hosting News","og_description":"If you&#8217;re running a WordPress site and haven&#8217;t updated it in the past week, now&#8217;s the time to check. Multiple cybersecurity firms, including Patchstack, Hexastrike, and WatchTowr, are warning that hackers are actively exploiting two critical vulnerabilities WordPress patched last week. The flaws are serious enough that WordPress pushed forced automatic updates where it could [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/","og_site_name":"Web Hosting News","article_published_time":"2026-07-20T16:55:21+00:00","article_modified_time":"2026-07-20T16:16:41+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/","url":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/","name":"Millions of WordPress sites face active attacks after critical bug found - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-07-20T16:55:21+00:00","dateModified":"2026-07-20T16:16:41+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/millions-of-wordpress-sites-face-active-attacks-after-critical-bug-found\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Millions of WordPress sites face active attacks after critical bug found"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":80,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10258"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10258\/revisions"}],"predecessor-version":[{"id":10259,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10258\/revisions\/10259"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}