Millions of WordPress websites could remain vulnerable after hackers began exploiting recently discovered security flaws. Although emergency patches have already been released, cybersecurity experts warn that websites running outdated versions continue to face serious risks.
The vulnerabilities affect multiple WordPress versions. As a result, website owners are being urged to install the latest updates immediately and review their systems for any signs of unauthorized access.
Hackers Exploit Newly Patched WordPress Flaws
Cybersecurity researchers have warned that attackers are actively exploiting two critical WordPress vulnerabilities. Instead of merely testing the flaws, hackers are reportedly using them to compromise websites that have not yet installed the latest security updates.
The affected versions include WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1.
Due to the seriousness of the vulnerabilities, WordPress released emergency security patches last week. Moreover, the platform enabled automatic updates wherever possible to reduce the risk of widespread attacks.
Millions of Websites Could Still Be Exposed
Although many websites have already received security updates, experts believe millions could still be vulnerable.
WordPress statistics indicate that more than 400 million websites have been running the affected versions. However, that figure may also include websites that have already been updated.
A cybersecurity consultant reviewed a sample of approximately 3,500 WordPress websites and estimated that fewer than 15 percent remained vulnerable. Even so, that estimate suggests nearly 90 million websites could still face potential attacks if they have not installed the latest patches.
Automatic Updates Reduce Security Risks
Security experts believe automatic updates have significantly limited the number of vulnerable websites.
In addition, web protection services and firewall technologies have helped block many attack attempts. These security measures have provided another layer of defense for website owners.
However, websites without updated software or proper security protections remain at greater risk of compromise.
One Vulnerability Could Allow Full Website Control
One of the critical vulnerabilities has been named WP2Shell by the cybersecurity researchers who identified it.
When combined with the second security flaw, the vulnerability could allow attackers to gain complete remote control of affected WordPress websites. Consequently, compromised websites may become vulnerable to unauthorized changes, malware installation, or data theft.
The discovery highlights the importance of keeping website software updated as soon as security patches become available.
Website Owners Urged to Update Immediately
Security experts recommend that all WordPress users verify their current software version and install the latest update without delay.
Furthermore, website owners should review administrator accounts, website files, server logs, and security alerts for any unusual activity. These checks are particularly important for websites that continued running affected versions after the security patches were released.
Timely updates remain one of the most effective ways to reduce cybersecurity risks. As hackers continue targeting outdated systems, keeping WordPress installations current is essential for protecting websites and maintaining user trust.
