WordPress Motors theme flaw mass-exploited to hijack admin accounts

**Executive Summary:** A critical privilege-escalation flaw (CVE-2025-4322) in the Motors WordPress theme enabled unauthenticated attackers to reset administrator passwords and take over sites; Wordfence observed active exploitation beginning May 20, 2025, with wide-scale attacks (Wordfence blocked 23,100 attempts) and published example payloads, attacker-set passwords, and IP addresses — site owners should apply the vendor patch (Motors 5.6.68), look for newly created admin accounts, and block malicious IPs.