Attackers have started breaking into websites that still run vulnerable versions of WordPress, and multiple cybersecurity firms say the activity is already underway. The scale is hard to pin down exactly, but one estimate places the number of exposed WordPress sites in the tens of millions as of Monday. If you run a site on WordPress and haven't updated it recently, this is the kind of thing you want to handle today, not next week.

The trouble traces back to two critical flaws that WordPress patched last week. The project didn't soft-pedal it either — it told site owners to update "immediately," and the bugs were serious enough that WordPress turned on forced updates wherever it could push them. That's not a routine move. It's the software equivalent of someone knocking on your door because the problem can't wait for you to notice on your own.

What the Two Critical WordPress Bugs Can Do

The danger here isn't theoretical. Security companies Patchstack, Hexastrike, and WatchTowr have each warned that hackers are actively exploiting these vulnerabilities in the wild — meaning real sites running susceptible versions are being taken over right now.

WP2Shell and Full Remote Control

One of the two critical bugs was discovered and reported by Adam Kues of the cybersecurity firm Searchlight Cyber, which named it WP2Shell. On its own, a single flaw is a problem. Chained together with the second bug, it's far worse: the pairing lets attackers seize full remote control of a vulnerable website. At that point, the intruder isn't just poking around — they own the site.

Which WordPress Versions Are Affected

If you're checking your own installation, these are the versions to watch for:

  • WordPress 6.9.0 through 6.9.4
  • WordPress 7.0.0 through 7.0.1

Anything in those ranges is exposed unless it has been patched. WordPress's own statistics show more than 400 million websites running the flawed versions, though that figure almost certainly overstates the current risk, since it doesn't fully account for sites that have already been updated in the days since the patch went out.

How Many Sites Are Genuinely at Risk

The raw numbers can be misleading, so it helps to look at what the people actually inspecting these sites are finding.

Cybersecurity consultant Daniel Card examined a sample of roughly 4,200 WordPress sites and estimated that fewer than 15% were still vulnerable. That's a meaningful correction to the headline figure — but "smaller share" doesn't mean "small problem." Apply that same 15% projection across the total population of WordPress sites online, and you still land at around 90 million potentially exposed websites.

So the picture is genuinely mixed. A lot of sites have already been protected. A staggering number still haven't. Both things are true at once.

Why the Damage Has Been Contained So Far

Here's the part that should be reassuring, at least a little: the number of sites that could realistically be hacked right now is smaller than the vulnerability counts suggest, and there are clear reasons why.

Card credited three things for keeping the fallout limited. First, WordPress pushing automatic updates, which quietly patched a large share of sites before their owners even had to act. Second, Cloudflare, which has been blocking attacks aimed at vulnerable sites. And third, the sites themselves that already run cybersecurity protections such as web application firewalls — those defenses are absorbing hits that would otherwise land.

In other words, the layered defenses that many site owners already had in place are doing exactly what they're supposed to do. The sites in real trouble tend to be the ones sitting outside all of that protection.

What WordPress Site Owners Should Do Right Now

The single most important step is straightforward: update to a patched version of WordPress without delay. WordPress has already enabled forced updates where it can, so some sites will be handled automatically. But automatic doesn't mean universal, and it's worth confirming your own installation rather than assuming it was covered.

If your setup allows it, keeping automatic updates turned on is one of the reasons so many sites dodged this in the first place. Pairing that with a web application firewall — the same kind of protection credited with blunting these attacks — gives you a second line of defense for the moments when a patch hasn't reached you yet.

Automattic and WordPress.org, the project that develops WordPress's open-source code, did not immediately respond to a request for comment.