Critical Vulnerability in WordPress: Millions of Sites Under Hacker Attack

Highly dangerous vulnerabilities have been discovered in the WordPress content management system (CMS), which powers millions of web resources worldwide. Cybersecurity experts warn that hackers have already launched mass attacks on sites running older versions of the system. This issue poses a serious threat to the security of not only personal blogs but also large corporate portals, reports Techcrunch.com reports .

Last week, WordPress developers released an update addressing two critical security flaws and urged all users to update their software "immediately." The severity of the situation is such that system administrators have enabled mandatory automatic updates on as many sites as possible. However, many sites remain at risk.

Scale of Risk and the WP2Shell Threat

Cybersecurity companies such as Patchstack, Hexastrike, and WatchTowr have confirmed that hackers are exploiting these vulnerabilities to gain full control over unprotected sites. According to TechCrunch, versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are particularly vulnerable. The flaw, identified by researcher Adam Kues and dubbed "WP2Shell," allows hackers to gain remote control of a site.

According to analysis by cybersecurity consultant Daniel Card, approximately 15 percent of WordPress sites on the internet remain unpatched. If this figure is applied to the total number of sites, nearly 90 million resources worldwide remain an "open door" for hackers. Official statistics suggest the number of sites running outdated versions could even exceed 400 million.

Considering that many information websites and business pages in the Uzbekistan segment are also built on the WordPress platform, this serves as a wake-up call for local IT specialists. To ensure site security, the following measures are recommended:

• Update the WordPress core to the latest secure version;
• Check and update all plugins and themes;
• Use protection services like Cloudflare and web application firewalls (WAF);
• Implement two-factor authentication for admin panel access.

Automattic, the company behind the WordPress project, has not yet issued an additional official statement regarding the situation. Experts emphasize that services like Cloudflare are blocking many attacks, but the most reliable method remains updating the system manually or automatically. Otherwise, hackers could inject malicious code or steal user personal data.