Hackers are actively attacking WordPress websites that haven't been updated yet, potentially gaining full control of those sites. Cybersecurity firms Patchstack, Hexastrike, and WatchTowr confirmed the attacks on July 20, 2026, just three days after WordPress released a fix on July 17 (TechCrunch).

WordPress version 7.0.2 patched two security holes. One was an SQL injection flaw, which means attackers can slip harmful commands into a website's data-entry points to tamper with its database (WordPress.org). The other, named WP2Shell, was found by Adam Kues of cybersecurity firm Searchlight Cyber. When the two flaws are used together, an attacker can take complete control of a website without needing a username or password (TechCrunch).

On July 19, someone published ready-made attack code online. That means less-skilled hackers can now try the attack without figuring it out themselves (SecurityAffairs). The window is narrow for site owners who haven't updated yet.

The vulnerable versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Over 400 million websites run these versions. WordPress tried to force updates after releasing 7.0.2, but whether that works depends on how each site is hosted (TechCrunch).

Cybersecurity consultant Daniel Card checked about 4,200 WordPress sites and estimated fewer than 15% are still vulnerable. Applied to the total number of WordPress sites, that suggests roughly 90 million sites could still be at risk. Cloudflare, a company that sits between websites and their visitors to filter traffic, has started blocking these attacks for sites using its service (TechCrunch).

Automattic and WordPress.org did not immediately respond to TechCrunch's request for comment (TechCrunch).

Also in July 2026, the WordPress security team added a tool called Zizmor to the Gutenberg project to tighten permissions and reduce risk (make.wordpress.org/security). Gutenberg is WordPress's editing system. The timing fits with other security improvements around the 7.0.2 release, though Zizmor addresses the editor's code, not the two flaws being actively exploited.

The attack itself is simple but devastating: one flaw lets attackers interfere with the site's database, and the second lets them run commands on the server. Together, they hand over full control. With over 400 million sites running the vulnerable versions, the potential reach is enormous. Card's 15% estimate, from a sample of 4,200 sites, gives a rough lower bound, but the raw number, 90 million, is what matters to attackers scanning the internet for easy targets.

The pattern here will be familiar to anyone who has watched website security over the years. WordPress runs so much of the internet that every major flaw becomes a race: can site owners update faster than attackers can exploit? The public exploit code appeared just two days after the fix was released. WordPress's forced updates help, but some hosting providers turn off automatic updates, some sites run custom setups that don't auto-update, and some sites hide behind services that make it hard to detect what version they're running.

If you run a WordPress site, the steps are straightforward: make sure every site is on version 7.0.2 or later, confirm that automatic updates actually went through, and if updates are still pending, use a web firewall to block the known attack patterns. Cloudflare's protections are already active. Other providers may have followed, though confirmed reporting only covers Cloudflare.