Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk

Multiple cybersecurity firms reported active exploitation of two critical WordPress vulnerabilities (versions 6.9.0–6.9.4 and 7.0.0–7.0.1) that can allow full remote control of sites when combined (one tracked as WP2Shell). WordPress issued forced updates and vendors like Cloudflare and Automattic deployed protections, but estimates suggest tens of millions of sites could have been vulnerable before patching.