Cybersecurity & Privacy

Hackers Exploit Patched WordPress Flaws—90M Sites Still Exposed

Forced updates couldn't save every site. Two critical bugs now power takeovers at scale.

Hackers are breaking into websites that run vulnerable versions of WordPress, and the campaign is moving fast. Last week the project shipped fixes for two critical security flaws and urged people running its software to update “immediately,” TechCrunch reports. The holes were severe enough that WordPress switched on forced updates wherever it could.

That safety net did not catch everyone. Since the patch landed, cybersecurity firms Patchstack, Hexastrike, and WatchTowr have all warned that attackers are actively taking over sites still running susceptible builds. One of the bugs was found and reported by Adam Kues of Searchlight Cyber, which dubbed it WP2Shell; chained with the second flaw, it lets an attacker seize full remote control of a website.

It is unclear exactly how many WordPress-powered sites are at risk, but the math is sobering. The flawed versions—6.9.0 through 6.9.4 and 7.0.0 to 7.0.1—power more than 400 million sites by WordPress’s own stats, though that figure includes machines already patched. Consultant Daniel Card told TechCrunch he sampled about 4,200 sites and found less than 15% vulnerable; stretched across the total population, that still lands near 90 million.

The exposed versions and why they matter

The vulnerable window spans two release lines that many site owners simply have not touched. WordPress’s official statistics suggest hundreds of millions of installations sit on those builds, and not every host can force an update without breaking a customer’s site. That gap is exactly where the current exploitation is happening.

Cloudflare is currently blocking attacks against vulnerable sites, and web-application firewalls are limiting the blast radius for the small fraction of installations that have them. Card credited WordPress’s automatic-update push and Cloudflare’s shielding as the reasons the practical number of compromised sites is lower than the raw exposure suggests.

Automattic and WordPress.org did not immediately respond to a request for comment. The episode is a reminder that open-source ubiquity cuts both ways: a single popular codebase means a single critical bug can threaten a meaningful slice of the web at once, as recent analysis of model-supply-chain risk also underscored.

What WordPress site owners should do now

If you run WordPress, the move is unglamorous but urgent: confirm your version is patched and that automatic updates are active. Sites on managed hosts likely already received the forced update, but self-hosted and abandoned installs are the ones attackers are hunting.

Rotating credentials is also worth doing. The WP2Shell chain can harvest login tokens once a site is compromised, so a patched core is not enough if an attacker already copied a session. The same class of risk shows up in AI-agent breaches where stolen credentials enable lateral movement.

The broader lesson is that “patched upstream” is not the same as “safe in the wild.” Until the long tail of unmaintained sites updates—or is retired—the exploitation will continue, and 90 million is a ceiling, not a floor.

FAQ

Which WordPress versions are affected?

The vulnerable builds are 6.9.0 through 6.9.4 and 7.0.0 to 7.0.1, according to WordPress’s own statistics cited by TechCrunch.

How many sites are actually at risk?

Consultant Daniel Card estimated less than 15% of a ~4,200-site sample was vulnerable; extrapolated across WordPress’s 400M+ figure, that implies roughly 90 million sites could remain exposed.

Can the attack be stopped without manual patching?

WordPress enabled forced updates where possible and Cloudflare is blocking attacks against vulnerable sites, but self-hosted and abandoned installs still need manual updates and credential rotation.