Millions of WordPress websites around the world are facing a growing cybersecurity threat as hackers actively exploit vulnerabilities in outdated plugins and themes, despite security patches already being available. Researchers warn that many website owners have failed to install critical updates, giving cybercriminals an easy opportunity to break into their systems.
Cybersecurity experts say attackers are using a new exploit chain known as WP2Shell to compromise vulnerable WordPress websites. The technique combines multiple previously disclosed plugin vulnerabilities, allowing hackers to gain remote code execution on websites that have not been updated. Once inside, attackers can upload malicious files, install malware, steal sensitive information and even take complete control of a website.
The latest findings underline a familiar but persistent problem in website security. Software developers often release patches soon after discovering vulnerabilities, but many users delay installing them because of concerns over compatibility, downtime or simple oversight. Hackers closely monitor these public disclosures and move quickly to target websites that remain unpatched.
Researchers estimate that millions of WordPress installations could still be vulnerable because many continue to use outdated plugins. WordPress powers more than 40 per cent of the world’s websites, making it one of the biggest targets for cybercriminals. Rather than attacking the WordPress core software itself, hackers frequently exploit weaknesses in third-party plugins and themes, which are often maintained by different developers and updated less consistently.
The WP2Shell attack works by chaining together known vulnerabilities that have already been fixed by plugin developers. Websites running older versions remain vulnerable even though patches have been available for months in some cases. Automated scanning tools allow attackers to search the internet for exposed websites within minutes, making small businesses, online stores, blogs, educational institutions and personal websites all potential targets.
Once hackers gain access, the consequences can be severe. They can inject malicious scripts, redirect visitors to fraudulent websites, steal login credentials, install ransomware or use compromised servers to launch further cyberattacks. In some cases, hacked websites are turned into phishing platforms or become part of larger botnets used to attack other systems.
Security researchers stress that website owners should not assume they are safe simply because WordPress itself is updated. Every installed plugin and theme must also be kept current. A single outdated plugin can provide enough access for attackers to compromise an entire website.
Experts recommend that administrators immediately review all installed plugins and themes, update them to the latest versions and remove anything that is no longer in use. Unused plugins, even if deactivated, can still pose a security risk if they contain vulnerabilities.
Cybersecurity professionals also advise enabling multi-factor authentication (MFA) for administrator accounts, using strong and unique passwords, restricting administrative access and maintaining regular website backups. Backups can significantly reduce recovery time if a website is compromised or data is lost during an attack.
Continuous monitoring is another important defence. Unusual login attempts, unexpected administrator accounts, unfamiliar files or sudden changes in website performance could all indicate that a website has been breached. Early detection allows administrators to isolate affected systems and prevent attackers from causing further damage.
The latest campaign highlights how quickly cybercriminals adapt once vulnerabilities become public. Security patches are designed to close these gaps, but they are only effective when users install them. Attackers often begin exploiting newly disclosed flaws within days, knowing that many organisations take weeks or even months to apply updates.
For businesses, a successful cyberattack can lead to service disruptions, financial losses, reputational damage and exposure of customer information. E-commerce websites are particularly attractive targets because they store payment details and personal data. Even smaller websites that hold little valuable information can be hijacked to distribute malware or host phishing pages targeting unsuspecting visitors.
Researchers say organisations should also implement web application firewalls, regularly audit user accounts, limit plugin installations to trusted developers and conduct periodic security assessments. These measures add multiple layers of protection and reduce the chances of successful exploitation.
The warning serves as an important reminder that cybersecurity is an ongoing process rather than a one-time task. Keeping software updated, removing unnecessary components and following basic security practices remain among the most effective ways to defend against modern cyber threats.
Also Read: Rupee drops 14 paise, closes at 96.44