Hackers Exploit Newly Patched WordPress Flaws, Threatening Millions of Sites

WordPress continues to dominate the web as the most widely deployed content management system, but its popularity also makes it a prime target for cyber‑criminals. A recent security analysis by independent researcher Alex R. uncovered two high‑severity vulnerabilities (CVE‑2026‑XXXX and CVE‑2026‑YYYY) that were patched in WordPress 6.5.2. Despite the release of the fixes, the researcher found that attackers are still leveraging the flaws to hijack sites at scale.

The first vulnerability is an authentication bypass that allows an unauthenticated attacker to forge a privileged REST‑API request, effectively stealing an admin session token and executing arbitrary commands on the server. The second issue lies in a poorly sanitized file‑upload routine used by a popular third‑party plugin; it enables remote code execution when a malicious payload is uploaded, giving the attacker full control over the compromised WordPress instance.

Both bugs were addressed in the July 2026 security update, yet the researcher estimates that 30‑40 million WordPress installations have not applied the patch. The gap is especially pronounced among low‑cost hosting providers and users who have disabled automatic updates. As a result, a large portion of the WordPress ecosystem remains exposed to active exploitation.

Security experts recommend immediate remediation steps for site owners:
1. Update the WordPress core, themes, and plugins to the latest versions without delay.
2. Enable automatic core and plugin updates to ensure future patches are applied instantly.
3. Remove any untrusted or abandoned plugins, and install only from the official WordPress repository.
4. Implement two‑factor authentication (2FA) for all admin accounts.
5. Deploy a web‑application firewall (WAF) that can block known exploit signatures.

The ongoing abuse of these patched bugs highlights a broader issue: many site operators treat updates as optional maintenance rather than a critical security measure. The WordPress community is responding by improving update notifications and rolling out more aggressive auto‑patch mechanisms. Until those changes take effect, administrators must act promptly, audit their installations, and harden their environments to keep the millions of WordPress‑powered sites safe from further compromise.

Source: TechCrunch

ETİKETLER