Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk
News Source
β’Mon, 20 Jul 2026 15:35:37 +0000
π° What Happened
Hackers are breaking into websites that run old versions of WordPress, the popular blogging software. WordPress patched two critical security flaws last week and urged users to update immediately. It even enabled forced updates where possible. But cybersecurity firms say hackers are now actively exploiting the flaws on websites that have not been updated. Estimates suggest tens of millions of websites could still be at risk. The vulnerable versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 to 7.0.1.
π The Backstory
WordPress powers more than 400 million websites around the world. That makes it a huge target for hackers. When security flaws are found, they are often quickly weaponized by attackers. This latest attack came just days after WordPress released fixes. The company pushed automatic updates, but not all websites can accept them. Some use custom setups that block auto-updates. Cybersecurity firms say the number of sites that could still be hacked is around 90 million. Users who have not updated are at serious risk of having their sites taken over.
π― Why It Matters
This matters because millions of websites run WordPress, including small businesses, blogs, and online stores. If you own a WordPress site, update it now before hackers take control.
Hackers are breaking into websites that run old versions of WordPress, the popular blogging software. WordPress patched two critical security flaws last week and urged users to update immediately. It even enabled forced updates where possible. But cybersecurity firms say hackers are now actively exploiting the flaws on websites that have not been updated. Estimates suggest tens of millions of websites could still be at risk. The vulnerable versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 to 7.0.1.
WordPress powers more than 400 million websites around the world. That makes it a huge target for hackers. When security flaws are found, they are often quickly weaponized by attackers. This latest attack came just days after WordPress released fixes. The company pushed automatic updates, but not all websites can accept them. Some use custom setups that block auto-updates. Cybersecurity firms say the number of sites that could still be hacked is around 90 million. Users who have not updated are at serious risk of having their sites taken over.
This matters because millions of websites run WordPress, including small businesses, blogs, and online stores. If you own a WordPress site, update it now before hackers take control.