Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk - TechCrunch

What the report says

TechCrunch reports that attackers are compromising websites running unpatched versions of WordPress after two critical flaws were fixed last week. WordPress urged site operators to update immediately and enabled forced updates where it could, reflecting the severity of the bugs. Security firms Patchstack, Hexastrike and WatchTowr have since warned that exploitation is occurring in the wild, meaning some vulnerable sites are already being taken over.

The affected WordPress releases are listed as versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. TechCrunch says WordPress’ own statistics show more than 400 million sites using those versions, though that figure may include many that have since updated. Cybersecurity consultant Daniel Card told the outlet he reviewed about 3,500 WordPress sites and estimated that under 15% remained exposed; extrapolated broadly, that could still mean roughly 90 million vulnerable sites.

Card credited WordPress’ automatic update push, Cloudflare’s attack blocking and the use of web application firewalls or similar defenses with reducing the number of sites that can currently be hacked. Automattic spokesperson Megan Fox told TechCrunch that sites hosted by Automattic services, including WordPress.com, Pressable, WPVIP and WP.cloud partners, were protected before the public release and received the updates immediately when available. WordPress.org did not immediately comment, according to the report.

One of the flaws was reported by Adam Kues of Searchlight Cyber, which named it WP2Shell. TechCrunch says that, when combined with the second bug, attackers can gain full remote control of sites that remain susceptible. The issue matters because WordPress is one of the most widely used website platforms, so even a relatively small unpatched share can translate into a large number of targets.