Hackers are attacking WordPress: millions of websites are at risk

TechCrunch reports on the ongoing attacks, citing cybersecurity firms.

Which WordPress sites are at risk?

The vulnerabilities affect the WordPress core, rather than third-party plugins or themes. This means that even a standard system configuration can be attacked.

The most dangerous is a combination of two vulnerabilities, known as WP2Shell. It involves the CVE-2026-60137 SQL injection vulnerability and the CVE-2026-63030 REST API request handling flaw.

Combining these vulnerabilities allows an unauthorised third party to execute malicious code on the server without authorisation. An attacker could potentially create an administrator account, steal information from the database, establish covert access, or use the website to distribute malware.

WordPress versions released prior to the 6.8 branch are not affected by these two vulnerabilities, according to researchers at VulnCheck.

Hackers are already exploiting WordPress vulnerabilities

Reports of attempted attacks emerged shortly after the updates were published. Patchstack recorded exploitation of both vulnerabilities on 17 July.

Hexastrike detected suspicious activity in its monitoring systems and subsequently joined the investigation into several incidents. Attempts to exploit WP2Shell were also confirmed by WatchTowr.

VulnCheck reported that its systems had detected attacks on live production environments. By 19 July, researchers had identified more than two dozen different proof-of-concept exploits circulating online.

This means that the threat is no longer theoretical. Hackers’ automated systems can scan for websites en masse whose owners have not yet installed the updates.

Are 90 million websites really at risk?

There is currently no exact figure for the number of vulnerable sites. Researchers emphasise that the estimate depends on how many sites have already received automatic or manual updates.

Cybersecurity consultant Daniel Card checked around 3,500 websites and concluded that fewer than 15 per cent of sites may remain unprotected. According to calculations cited by TechCrunch, if this ratio is applied to the entire WordPress ecosystem, the number of potentially vulnerable websites could be close to 90 million.

This is an approximate extrapolation from a limited sample, rather than a confirmed figure for the number of compromised sites. Some sites have already been updated, whilst others may be protected by hosting providers, Cloudflare or web application firewalls.

What is WP2Shell

The WP2Shell vulnerability was discovered by Adam Kues, a researcher at Searchlight Cyber. According to the company, the attack can be carried out against a standard WordPress installation without any additional plugins or prior access to the site.

WP2Shell exploits a flaw in the processing of batch requests by the WordPress REST API, combined with an SQL injection. As a result, an attacker can bypass the intended restrictions and gain the ability to execute commands on the server.

Searchlight Cyber did not initially disclose the full technical details to give administrators time to apply the patch. However, third-party researchers have already created and released working demonstrations of the attack.

How to protect a WordPress site

Administrators need to open the WordPress dashboard and check the current version of the system. For the 6.8 branch, version 6.8.6 must be installed; for the 6.9 branch, version 6.9.5; and for the 7.0 branch, version 7.0.2 or later.

WordPress has enabled forced automatic updates for some of the vulnerable sites. However, experts advise against relying solely on this mechanism, as the update may not have been installed due to server settings, a lack of access to files, or background updates being disabled.

If it is not possible to update the system immediately, a temporary safeguard is to block unauthorised access to the REST API using the web application dashboard. However, researchers emphasise that such restrictions are no substitute for installing the patched version.

After updating, you should check the list of administrators, login logs, installed plugins and site files. The presence of unknown accounts, altered pages or suspicious files may indicate a breach that occurred before the patch was installed.

Are WordPress.com sites protected?

A spokesperson for Automattic told TechCrunch that sites hosted on WordPress.com, Pressable, WordPress VIP and WP.cloud were secured even before the update was publicly released.

Once the patches were released, they were automatically installed on millions of websites running on the company’s infrastructure. Owners of websites running self-hosted WordPress on third-party hosting providers will need to check for updates separately.

Follow us on Telegram!