AI discovers two critical WordPress flaws being massively exploited

What happened?

Two critical vulnerabilities in WordPress are being actively exploited on a large scale, according to security reports. The first, identified as CVE-2026-4020, affects the Gravity SMTP plugin, used by more than 200,000 sites for sending transactional emails. The second, still without an official designation, compromises the WordPress core and allows remote code execution. Both were detected by an artificial intelligence system from an unnamed security firm, which identified anomalous traffic patterns directed at sites with vulnerable plugins. According to The Next Web, attacks began within hours after patches were released, suggesting attackers either had prior knowledge of the flaws or quickly reverse-engineered them. The mass exploitation includes injection of malicious scripts and theft of API keys, allowing full control over affected sites.

Why is it important?

WordPress powers more than 43% of all websites worldwide, from personal blogs to large corporate portals like TechCrunch and The New Yorker. The mass exploitation of these vulnerabilities could compromise millions of sites, allowing attackers to take full control, steal user data, install backdoors, or redirect traffic to malicious sites. The speed of attacks outpaces many administrators' ability to update, leaving a critical exposure window. According to Wordfence data, within the first 24 hours after disclosure, more than 2 million exploitation attempts were recorded. This marks a milestone in propagation speed, surpassing even the 2023 'WP2Shell' attack, which affected 500,000 sites in a week.

Consequences and recommendations

Immediate consequences include the urgent need to apply patches on all WordPress sites. Administrators must update the core, plugins, and themes to the latest versions. In particular, Gravity SMTP should be updated to version 2.9.1 or higher, which fixes CVE-2026-4020. Additionally, it is recommended to review access logs for suspicious activity, such as requests to 'wp-admin/admin-ajax.php' with unusual parameters. Implementing a web application firewall (WAF) can mitigate known attacks, while multi-factor authentication adds an extra layer of security. In the long term, this incident underscores the importance of proactive security and the use of AI for early threat detection. However, it also highlights the need to accelerate update processes in enterprise environments, where critical sites often have scheduled maintenance windows.

Historical context

This is not the first time WordPress has faced mass exploitation. In 2023, the 'WP2Shell' vulnerability (CVE-2023-4560) in the 'Elementor Pro' plugin allowed attackers to execute arbitrary code, affecting more than 500,000 sites in a week. In 2022, the 'CVE-2022-21661' flaw in the WordPress core exposed databases of millions of sites. The difference now is the use of AI to detect exploitation, marking a milestone in cybersecurity. However, it also warns that attackers may be using AI to find and exploit flaws faster than ever. According to a CrowdStrike report, the average time to exploitation after a CVE disclosure has dropped from 45 days in 2020 to just 5 hours in 2025, driven by automated tools. This case confirms that trend.

"AI is not only helping defend but also accelerating attacks. This is a real-time arms race." — Analyst at TheVortiq

What should readers know?

• Update your WordPress site immediately to the latest version (6.7.2 or higher).
• Ensure all plugins and themes are updated, especially Gravity SMTP (2.9.1+).
• Monitor server logs for unauthorized access or requests to sensitive files.
• Consider using a managed security service like Sucuri or Wordfence for critical sites.
• Implement an incident response plan that includes regular backups and restoration procedures.

In conclusion, the speed and scale of this exploitation demand immediate action. AI has proven to be a double-edged sword: while it helps detect threats, it also enables attackers to act faster. The lesson for the WordPress community is clear: security must be an ongoing priority, not a reaction to incidents.