Hackers are breaking into websites that run vulnerable versions of the popular blogging software WordPress, according to several cybersecurity firms. One estimate puts the number of vulnerable WordPress websites at tens of millions as of Monday<\/p>\n
Last week, WordPress patched two critical security flaws<\/a>, urging people who run its software on their websites to update it \u201cimmediately.\u201d The vulnerabilities are so severe that WordPress enabled forced updates where possible. Since then, cybersecurity companies Patchstack, Hexastrike, and WatchTowr have all warned<\/a> that hackers are exploiting the vulnerabilities in the wild, meaning they are taking over websites that are still running susceptible versions of WordPress.\u00a0<\/p>\n It\u2019s unclear how many WordPress-powered websites on the internet are at risk, but it\u2019s possible to make some educated guesses. The vulnerable versions of WordPress are 6.9.0 through 6.9.4, and 7.0.0 to 7.0.1. According to WordPress\u2019 official stats, there are more than 400 million websites that run those flawed versions, although these statistics likely don\u2019t reflect websites that have recently been patched.<\/p>\n Cybersecurity consultant Daniel Card, who told TechCrunch<\/a> that he looked at a sample of around 3,500 WordPress websites, estimates that less than 15%are vulnerable. Applying Card\u2019s projection across the total population of WordPress websites on the internet, the total figure would still be around 90 million<\/p>\n The researcher credited WordPress with pushing automatic updates, Cloudflare with blocking attacks<\/a> against vulnerable websites, and websites using cybersecurity protections such as web firewalls for the limited number of sites that could currently be hacked.\u00a0<\/p>\n WordPress.org, the project that develops WordPress\u2019 open source code, did not immediately respond to a request for comment.\u00a0Megan Fox, a spokesperson for Automattic, the company that runs WordPress.com and contributes to the open source project, told TechCrunch that \u201call sites hosted by Automattic, including WordPress.com<\/a>, Pressable, WPVIP, and WP.cloud partners, were protected even before the release. When the code updates were published, we deployed them immediately across millions of sites.\u201d<\/p>\n One of the critical WordPress bugs was found and reported by Adam Kues of cybersecurity firm Searchlight Cyber, which dubbed it WP2Shell. Paired with the other bug, hackers can take full remote control of vulnerable websites<\/p>\n \n En rapport:<\/strong> \n <a href="https:\/\/yoursite.com\/automation-africa\/" title="WhatsApp<\/a> Automatisation du marketing en Afrique : 6 Danger<\/a>Les erreurs que font les marques au Nig\u00e9ria\u201d> Rejoindre Justfine Infotech<\/strong> et d\u00e9velopper de v\u00e9ritables comp\u00e9tences num\u00e9riques en IA, automatisation, d\u00e9veloppement web, marketing digital, bureautique, e-commerce, travail ind\u00e9pendant et cybers\u00e9curit\u00e9.<\/p>\n Programmes disponibles :<\/strong> WhatsApp :<\/strong>
\n
\n Formation en automatisation num\u00e9rique au B\u00e9nin\u00a0: 5 comp\u00e9tences cl\u00e9s recherch\u00e9es par les employeurs en 2026
\n <\/a>\n <\/p>\n
\n Automatisation du marketing WhatsApp en Afrique\u00a0: 6 erreurs dangereuses commises par les marques au Nig\u00e9ria
\n <\/a>\n <\/p>\n<\/div>\nVous souhaitez apprendre cela de mani\u00e8re pratique ?<\/h3>\n
\n Certificat de 6 semaines \u2022 Certificat professionnel de 3 mois \u2022 Dipl\u00f4me de 6 mois \u2022 Dipl\u00f4me professionnel complet<\/p>\n
\n +229 01 57 57 99 15
\n +229 01 66 68 11 60<\/p>\n