Hackers exploit unpatched WordPress bugs

Hackers are exploiting two critical unpatched WordPress flaws in versions 6.9.0 through 6.9.4 and 7.0.0 to 7.0.1, taking full remote control of vulnerable websites. WordPress pushed forced automatic updates, but cybersecurity consultant Daniel Card estimates less than 15% of a sample of 3,500 sites remain vulnerable, still potentially affecting tens of millions of sites.