WordPress Flaw Attacked 63,000 Times in 24 Hours

Attackers are exploiting a new WordPress remote code execution flaw at massive scale, just one day after security patches were released.

A high-severity vulnerability in WordPress Core is being actively and aggressively exploited, with security researchers reporting nearly 63,000 attack attempts within the first 24 hours of a patch being released. According to reporting from The Hacker News, the flaw allows for remote code execution (RCE), giving an attacker the ability to take complete control of an unpatched website. The vulnerability, which carries a CVSS score of 8.1, affects a wide range of WordPress versions, from 4.1 up to 6.4.2. The immediate and widespread nature of the attacks highlights the significant risk to the millions of websites built on the platform, making swift action essential for site administrators and security teams.

Technically, the vulnerability is a sophisticated Property-Oriented Programming (POP) chain exploit. It resides within the HTML API, a feature introduced in WordPress 6.2 to process HTML content. An unauthenticated attacker can submit a specially crafted payload that, when processed by the vulnerable `WP_HTML_Token` class, chains together existing pieces of code (known as “gadgets”) in an unintended sequence. This chain of operations ultimately allows the attacker to execute arbitrary PHP code on the server. Because this can be triggered without needing to log in, it represents a worst-case scenario for a web application vulnerability. The exploit is complex to craft from scratch but easy to automate once developed, explaining the rapid and massive scale of the observed attacks.

The incident is a textbook example of the “patch gap,” the critical window of time between when a security fix is released and when the majority of systems are updated. As soon as a patch is published, its code can be reverse-engineered by malicious actors to create a functional exploit. In this case, attackers were able to weaponize the vulnerability and launch a global campaign in less than a day. This rapid turnaround demonstrates the efficiency of modern threat actor networks and the industrial scale of vulnerability exploitation. For an ecosystem as large as WordPress, which powers over 40% of the web, even a small percentage of unpatched sites represents millions of potential targets for automated scanning and compromise.

For organizations running WordPress, the primary takeaway is the urgent need to patch. However, this event also serves as a critical reminder that a reactive patching strategy alone is insufficient. The speed of exploitation means that a defense-in-depth approach is non-negotiable. This includes implementing a Web Application Firewall (WAF) to provide “virtual patching” that can block exploit attempts before they reach the server, enabling robust logging to detect signs of compromise, and maintaining an incident response plan. The fact that this particular flaw was not assigned a CVE identifier also complicates matters, as it may not be flagged by all automated security scanners. This reinforces the need for diligent, manual verification that all systems are running the latest secure versions.

This RCE vulnerability allows unauthenticated attackers to execute arbitrary code, effectively gaining complete control over a WordPress site. For developers and security teams, this represents a critical threat that bypasses many standard defenses and requires immediate patching to prevent server compromise and data breaches.

A compromised WordPress site can lead to significant business disruption, including data theft, reputational damage, and financial loss from cleanup and recovery. With millions of businesses relying on WordPress, this widespread and automated attack campaign poses a severe risk to unpatched sites globally.