Hackers Exploit Patched WordPress Bugs - Millions of Sites Still at Risk

Your WordPress site has zero plugins installed. Fresh deployment, bone-stock configuration. And it’s already vulnerable to full remote takeover — no login required. A chainable pair of bugs in the WordPress REST API, dubbed “WP2Shell,” lets attackers turn your site into their personal command line. WordPress 7.0.2 patches the flaws. The problem: tens of millions of sites haven’t updated yet, and automated exploit scanners are already sweeping the web like robocall bots that never sleep — the kind of computer problems that demand immediate action.