Tens of millions of websites are under active attack after hackers discovered critical security flaws in WordPress that allow complete remote takeover of vulnerable sites. According to cybersecurity researchers tracking the exploits, the two vulnerabilities affect WordPress installations globally, putting roughly 40% of the entire web at risk. The patches were recently released, but millions of site owners haven't updated yet - and attackers are moving fast.

WordPress just became the internet's biggest security liability. Two critical vulnerabilities in the platform's core software are being actively weaponized by hackers to seize control of websites, and the window for protection is closing fast.

The flaws allow remote attackers to take complete control of vulnerable WordPress installations without any authentication, according to cybersecurity researchers monitoring the attacks. With WordPress powering an estimated 43% of all websites on the internet - that's roughly 835 million sites - the scope of this threat is staggering.

What makes this particularly dangerous is the timing. Patches were released recently, but the reality of WordPress adoption rates means millions of site owners are running outdated versions. Every hour that passes without updating represents another opportunity for attackers to slip in undetected.

The technical details of the vulnerabilities haven't been fully disclosed publicly yet, likely to prevent wider exploitation. But security researchers who spoke to TechCrunch confirmed that active exploitation is already underway. The attacks allow hackers to remotely execute code on vulnerable servers, effectively giving them the keys to the entire website.

Advertisement

This isn't just about defaced homepages or stolen databases. A compromised WordPress site can be turned into a distribution point for malware, a phishing platform, or a node in a larger botnet. For e-commerce sites running WooCommerce or other payment systems, the implications are even more severe - customer data, payment information, and business records all become accessible.

The vulnerability appears to affect WordPress core software rather than third-party plugins, which makes it more concerning. While plugin vulnerabilities are common and typically affect smaller subsets of sites, core WordPress flaws impact virtually everyone running the platform.

For context, WordPress has faced security challenges before, but rarely at this scale with active exploitation confirmed so quickly. The platform's massive market share makes it a perpetual target for security researchers and hackers alike. But the speed at which these particular flaws are being exploited suggests they're relatively easy to weaponize.

The WordPress security team has pushed automatic updates for some versions, but many site owners disable auto-updates for fear of breaking custom configurations or plugins. That decision is now backfiring as attackers scan the internet for vulnerable installations.

Security experts recommend immediate action. Site administrators should update to the latest WordPress version immediately, verify that all plugins and themes are current, and check server logs for any suspicious activity. For sites that have been compromised, a full audit and potentially a complete rebuild from clean backups may be necessary.

Advertisement

The broader implications extend beyond individual websites. Hosting providers like GoDaddy, Bluehost, and SiteGround are scrambling to patch vulnerable installations on their managed WordPress services. But for the millions of self-hosted WordPress sites, responsibility falls entirely on individual site owners.

This incident also highlights the fragile nature of web infrastructure. When a single platform powers nearly half the internet, any vulnerability becomes a systemic risk. The question isn't whether WordPress can patch the flaws - they already have - but whether hundreds of millions of site owners will act fast enough to prevent widespread compromise.

For enterprise users running WordPress at scale, this serves as a reminder that open-source doesn't mean maintenance-free. Companies relying on WordPress for business-critical applications need robust update policies and security monitoring systems that can detect and respond to threats in real-time.

The WordPress security crisis unfolding right now is a wake-up call for the entire web ecosystem. With active exploitation confirmed and millions of sites still vulnerable, this isn't a drill - it's a race against time. Site owners need to update immediately, and the broader tech community needs to reckon with the risks of having so much of the internet built on a single platform. The patches are available, but they're only useful if people actually install them. For the millions of WordPress sites still running outdated versions, every minute of delay is an invitation to hackers who are already at the door.