WordPress Under Active Attack: Two Critical Flaws Put Millions at Risk

Cybercriminals have begun launching real attacks against WordPress websites using two newly discovered security weaknesses. The vulnerabilities, identified as CVE-2026-60137 and CVE-2026-63030, became targets for hackers almost immediately after security researchers publicly announced their existence.

This rapid attack pattern represents a significant threat to the millions of websites running WordPress globally. The speed at which attackers moved from learning about these flaws to launching exploits shows how dangerous the current threat landscape has become for website owners who don't stay vigilant about security updates.

What this means

Think of WordPress vulnerabilities like unlocked doors in a building. When someone discovers an unlocked door and tells everyone about it, criminals take notice. They quickly move to exploit that opening before the building owner can install a new lock.

These two specific flaws create pathways for attackers to gain unauthorized access to WordPress installations. The vulnerabilities likely allow hackers to bypass normal security protections or inject malicious code into websites. When attackers gain such access, they can steal sensitive information, plant malware, deface websites, or use compromised sites to attack other targets.

The fact that exploitation began so quickly suggests the vulnerabilities are relatively easy to use. This means attackers with varying levels of technical skill can potentially weaponize these flaws, not just sophisticated criminal organizations.

Why you should care

If you run a WordPress website—whether for a business, blog, portfolio, or community—this directly affects your security posture. WordPress powers roughly 43% of all websites on the internet, making it an enormous target for criminals seeking to compromise multiple sites efficiently.

Beyond immediate damage to your own site, compromised WordPress installations can harm your visitors. Attackers frequently inject code that spreads malware to people visiting infected websites. This damages your reputation and potentially exposes your audience to financial loss or identity theft.

Additionally, hosting providers and website security services often suspend sites that become compromised, taking your business offline. The financial and reputational costs of dealing with a breach far exceed the minimal effort required to prevent one.

What you can do

Take these steps immediately to protect your WordPress installation:

• Update everything. Install available updates for WordPress core, all plugins, and all themes right away. Security patches for these vulnerabilities should be rolling out quickly.
• Check your plugins. Identify which plugins you actually use and remove unused ones. Each plugin represents another potential entry point for attackers.
• Enable automatic updates. Configure WordPress to automatically install security updates so you're never caught off-guard by future discoveries.
• Use strong credentials. Ensure your admin account uses a unique, complex password and enable two-factor authentication if your hosting supports it.
• Implement backups. Regular automated backups allow you to restore your site quickly if compromise occurs despite your precautions.
• Consider professional scanning. Security scanning services can identify if your site has already been compromised.

The window between when vulnerabilities become public and when attackers begin exploiting them continues to shrink, making proactive security management essential for anyone running a WordPress website.