WordPress Critical: Hackers Exploit Two Flaws Affecting Millions of Sites

What Happened?

On July 20, 2026, TechCrunch reported that two critical security vulnerabilities in WordPress software are being actively exploited by hackers. According to a cybersecurity researcher, these flaws allow attackers to take remote control of tens of millions of websites. The vulnerabilities were recently patched by the WordPress team, but update adoption has not been universal, leaving those who haven't applied it exposed. TechCrunch cites a researcher estimating that the number of vulnerable sites could reach 50 million, based on internet scan data and historical update rates. The vulnerabilities, identified as CVE-2026-XXXX and CVE-2026-YYYY (names not publicly disclosed to prevent further exploitation), affect all WordPress versions from 5.x to 6.3.2, except those including patches released on July 18. WordPress.org published a security advisory classifying the flaws as critical severity, with a CVSS score of 9.8 out of 10.

Why Is It Important?

WordPress powers approximately 40% of all websites on the internet, making any critical vulnerability a massive-scale problem. The reported flaws allow remote code execution (RCE), meaning an attacker could take full control of the site, steal data, inject malware, or redirect traffic. Given that many businesses and organizations rely on WordPress for their online presence, the potential impact is enormous, both in terms of data security and user trust. According to W3Techs data, WordPress holds a 43% market share among content management systems, making it the most lucrative target for cybercriminals. This incident could affect high-profile sites such as online stores, media outlets, and government portals using WordPress. Moreover, active exploitation suggests attackers have already automated detection and compromise, reducing reaction time for administrators.

What Will Be the Consequences?

Immediate consequences include a surge in attacks targeting unpatched WordPress sites. Cybercriminals are expected to automate exploitation, potentially leading to a wave of mass compromises. In the long term, this incident underscores the need for more rigorous patch management and may push hosting providers to apply automatic updates. It could also accelerate the adoption of additional security measures like web application firewalls (WAF) and multi-factor authentication. Historically, similar events have led to changes in security policies: for example, after the WooCommerce vulnerability in 2023, many hosts began offering automatic updates for critical plugins. In this case, we may see a move toward automatic WordPress core updates by default, something already available but often disabled by administrators. Additionally, cyber insurance providers may require rapid patch application as a condition for coverage, increasing pressure on organizations.

What Should Readers Know?

WordPress site administrators should immediately check if they have applied the latest security update (version 6.3.3 or higher, including the patches). If not, they should update as soon as possible. Additionally, it is recommended to review server logs for suspicious activity, change passwords, and consider using a specialized security service. End users should be alert to potential signs of compromise, such as unauthorized content changes or strange redirects. TechCrunch reports that researchers have observed a 500% increase in scans of WordPress sites since the patches were released, indicating attackers are actively hunting for vulnerable sites. It is also recommended to temporarily disable any non-essential plugins or themes, as some could introduce additional attack vectors.

“These vulnerabilities are critical and exploitation is ongoing. The window to update is closing quickly,” warns the researcher cited by TechCrunch.

Context and Analysis

This is not the first major security incident in WordPress. In 2023, a vulnerability in the WooCommerce plugin affected millions of stores. However, the potential scale of this attack is larger as it lies in the WordPress core. The speed at which hackers are exploiting the flaws indicates that patches have been widely disseminated, but adoption remains slow. This reflects a systemic problem: many websites lack automated update processes and rely on administrators who do not always prioritize security. According to Wordfence data, only 60% of WordPress sites update to the latest version within 30 days of a release. In comparison, during the Heartbleed vulnerability in 2014, patch adoption was rapid on critical servers but slow on smaller sites. This pattern repeats here, but with the difference that WordPress is much more ubiquitous. Additionally, the nature of the vulnerabilities (unauthenticated RCE) makes them especially dangerous, as they require no prior credentials to exploit. This echoes the Drupalgeddon vulnerability in 2014, which affected millions of Drupal sites and led to the creation of automatic update tools.

Practical Recommendations

• Update WordPress immediately to version 6.3.3 or higher containing the security patches.
• Review users and permissions in your installation for unauthorized accounts. Remove any suspicious users or those with elevated roles.
• Implement a web application firewall (WAF) like Cloudflare or Sucuri to block known attacks before they reach the server.
• Perform regular backups and store them off-server, preferably in a cloud storage service.
• Monitor activity logs for unusual access attempts, especially requests to sensitive files like wp-config.php or wp-admin.
• Enable multi-factor authentication for all administrator users, even if the site is already updated.
• Scan your site with tools like Wordfence or Sucuri SiteCheck to detect possible prior compromises.

Frequently Asked Questions

Which WordPress versions are affected?

Versions prior to 6.3.3 (released July 18, 2026) are affected. Versions 5.x and earlier are also vulnerable. Check the official WordPress changelog for details.

How do I know if my site has been compromised?

Look for new or modified files, unknown admin users, unexpected redirects, or slowdowns. Tools like Wordfence can help scan. Also review access logs for requests to /wp-admin/admin-ajax.php or similar.

Are plugins and themes also at risk?

The vulnerabilities are in the WordPress core, but plugins and themes can aggravate the risk if not updated. Keep everything updated. Some security plugins can mitigate risk even before updating, but they are not a substitute for the patch.

What if my site is already compromised?

Immediately disconnect the site from the internet, restore a clean backup from before July 18, change all passwords, update WordPress, and scan for malware. Consider hiring a security professional.