technology
WordPress Patches Two Critical Flaws and Forces Updates on Millions of Sites
@techcrunch reported that WordPress fixed two severe security issues last week and enabled forced updates. Hackers are now exploiting the flaws on unpatched sites. Estimates place tens of millions of websites at risk of remote takeover.
Jul 20, 11:39 AM·1m read2 sources
TechcrunchAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
WordPress released patches for two critical security flaws last week and enabled forced updates for affected installations where possible. @techcrunch reported that cybersecurity firms Patchstack, Hexastrike and WatchTowr have confirmed hackers are exploiting the vulnerabilities in the wild. 1.
WordPress urged administrators to update immediately. Official statistics show more than 400 million websites run the listed versions, though some have likely been patched since the fixes appeared. Cybersecurity consultant Daniel Card sampled roughly 4,200 sites and estimated fewer than 15 percent remain vulnerable, producing a projection of around 90 million exposed websites.
One flaw, reported by Adam Kues of Searchlight Cyber and named WP2Shell, combines with the second to grant full remote control of affected sites. Automattic and WordPress.org did not respond to requests for comment.
Transparency
How sources framed this
These outlets didn't split into competing frames — coverage was uniform.
CorroborationModerate · 2 sources
