Two WordPress flaws are being exploited right now
WordPress runs roughly four in ten websites on the internet. This week, two serious holes in it are under active attack. Here is what that means for your business, and the ten-minute check that protects you.
By Lennart Lopin, CISSP · Sarasota Consulting
If your company website runs on WordPress, and there is a good chance it does, this is worth ten minutes of your attention today. Over the past week, security agencies confirmed that attackers are actively exploiting two separate flaws in WordPress itself. Not a plugin, not a theme. The core software your site is built on.
"Actively exploited" is the phrase that matters. These are not theoretical. The U.S. government's Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities list, which is its way of saying criminals are using these in the wild, today, and you should treat them as urgent.
What this actually means for you
Both flaws allow something called unauthenticated remote code execution. Strip the jargon and it means a stranger on the internet can take control of your website without a password and without you clicking anything. Once they are in, the damage is the ordinary nightmare: your site defaced, customer information stolen, your pages quietly rigged to infect the people who visit them, Google flagging your site as dangerous, and days of downtime while you clean it up. For a local business, a blacklisted or defaced site means lost calls, lost bookings, and a dent in the reputation you spent years building.
The two flaws
- Affects: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1
- Fixed in: 6.9.5 and 7.0.2
- Status: Exploit code is public and widespread; active attacks confirmed Nov 2.
- Affects: nearly every WordPress from 4.7 through 7.1.3 (about nine years of releases)
- Fixed in: 7.1.4
- Status: Added to CISA's exploited list Nov 3. Unusually, it strikes during the update itself.
Am I affected? The two-minute check
Log into your site's admin area, usually yoursite.com/wp-admin. Look at Dashboard → Updates, or the version number shown at the bottom of the screen. If you are not on WordPress 7.1.4 or newer, assume you could be exposed and keep reading.
What to do today
- 01 Back up your site first. Any decent host or backup plugin can do this. If an update goes sideways, you want a safe copy to fall back on.
- 02 Update WordPress core now. In most cases it is one button under Dashboard → Updates. Get to 7.1.4 or newer.
- 03 Don't assume auto-updates saved you. WordPress can update itself, but plenty of sites have that turned off, managed hosts handle it differently, and one of these flaws targets the update window specifically. Check the version number afterward to be sure it took.
- 04 Update plugins and themes too while you are in there. They are the other common way in.
- 05 Look for anything out of place: admin accounts you do not recognize, posts or files you did not create. If you find something, or you are not sure, get help before it spreads.
The honest bigger picture
Here is the uncomfortable part. You learned about this because it made the news. Most small businesses do not. They find out they were exposed after the break-in, from a customer or from Google. The gap between a flaw going public and criminals mass-scanning the whole internet for it is now measured in hours, not weeks.
Keeping a website safe is not a once-a-year task anymore. It is maintenance, like changing the oil. The sites that get hurt are almost never the ones somebody was watching. They are the ones nobody was.
We are a Sarasota company with a cybersecurity practice led by a CISSP, and keeping local businesses' websites current and safe is part of what we do. If you would like us to check where your site stands, or take the updates and monitoring off your plate so you never have to read an article like this again, give us a call.
And whatever you decide: go update WordPress today.
Sources: WordPress 7.0.2 and 7.1.4 release advisories (wordpress.org), Wordfence Threat Intelligence, and the CISA Known Exploited Vulnerabilities Catalog. Version details current as of November 8, 2026; always confirm against the official WordPress advisory for your release.