Hackers are exploiting security vulnerabilities in vulnerable versions of the popular blogging software WordPress, putting millions of websites at risk, according to multiple reports from cybersecurity companies, with estimates indicating that tens of millions of WordPress sites were vulnerable to hacking.

90 million sites at risk of hacking

WordPress had fixed two critical security vulnerabilities last week, urging its users to update their software immediately, while cybersecurity companies Patchstack, Hexastrike, and WatchTowr confirmed that hackers are already exploiting these vulnerabilities, allowing them to take control of websites still running vulnerable WordPress versions.

Official statistics from WordPress indicate that more than 400 million websites use these vulnerable versions, with 15% of these sites examined in a sample of 4,200 WordPress sites still at risk, exposing 90 million sites to potential hacking, while new versions and cloud platforms limit these attacks.

Cybersecurity company Searchlight Cyber discovered one of the critical WordPress vulnerabilities, dubbed WP2Shell, and reported it directly; combined with the other vulnerability, hackers can gain full remote control over vulnerable websites, as continuously updating WordPress software remains crucial to protect sites from evolving cyber threats, underscoring the importance of constant security vigilance for users.