Hackers are always on the prowl, always looking for vulnerable websites. Over the years, attacks have become more frequent, aggressiveness has intensified, and methods have grown more sophisticated. Among their favorite targets are open-source CMS platforms such as Joomla, Magento, OpenCart, PrestaShop, Ghost, Craft, TYPO3, Drupal, and WordPress. Among them, WordPress is by far the most targeted CMS, accounting for approximately 90% to 96% of all hacked CMS websites in 2026.
WordPress is a free, open-source content management system created by Matt Mullenweg and Mike Little. It was originally made for blogging, but its functionality has expanded to include running e-commerce stores, membership sites, learning management systems (LMS), portfolios, forums, and applications, and is used by 41.2% to 42.5% of all websites on the internet. This is why hackers prioritize it above all other platforms; its massive market share makes it a lucrative target.
How do hackers hack you?
There are different ways for a hacker to hijack your CMS. Before launching an attack, they first probe your website for vulnerabilities; these are no longer manually done but are executed with the aid of scripts. The probe attempts to identify which CMS your website is running on and locate available exploitable endpoints.
For WordPress, here are some of the exploits used:
- XML-RPC
This is a legacy protocol that allows external applications to communicate with your WordPress site over HTTP using XML data. It was originally created to enable remote posting from desktop clients (like Windows Live Writer) and mobile apps. It allows third-party software to execute functions like publishing posts, managing comments, or handling pingbacks without logging into the dashboard.Hackers can use this endpoint to create hundreds of login attempts in a single request. The request is usually packed with random username and password combinations and stolen user credentials, trying to guess your login credentials. One correct guess can enable hackers to hijack your website.
Hackers also use this endpoint to launch DDoS attacks using XML-RPC’s pingback.ping function and force your server to send requests to a victim site, turning your website into a weapon for Distributed Denial of Service attacks.
Another problem with XML-RPC is that it can be used to enumerate usernames and probe for other vulnerabilities without authentication.
- REST API
The WordPress REST API is a built-in interface that allows external applications to interact with a WordPress site by sending and receiving data in JSON format. It functions similarly to XML-RPC but is regarded as more secure. However, this doesn’t mean it’s completely foolproof.Hackers use this endpoint to conduct user enumeration. If not restricted, the API returns a JSON list of all users who have published posts, including their usernames, IDs, and in some older configurations, email addresses. Attackers use this list to launch targeted brute-force or credential stuffing attacks against known usernames, significantly increasing their success rate compared to guessing random usernames.
Hackers can use the API to map the site’s infrastructure without logging in. This includes identifying installed plugins and themes. Attackers cross-reference this info with known CVEs to launch targeted exploits against outdated plugins.
Perhaps, the most severe recent threat involves the API’s Batch Endpoint. This vulnerability (comprising CVE-2026-63030 and CVE-2026-60137, dubbed wp2shell) was discovered by Adam Kues of Searchlight Cyber, with the underlying SQL injection component reported by TF1T, dtro, and haongo. Using these exploits, hackers can send a specially crafted batch request that confuses WordPress’ routing logic, allowing them to bypass authentication checks and chain the error into a SQL injection. This chain enables unauthenticated Remote Code Execution (RCE), where an attacker can create a new administrator account, upload malicious software, and take full control of the server without ever logging in.
- WP Login
WordPress Login Gate or wp-login.php is the most common attack vector. Automated bots attempt thousands of username/password combinations on this gateway, and since WordPress uses bcrypt for password hashing (which is intentionally slow), high-volume attacks can also degrade server performance or cause denial of service.Beyond guessing passwords, hackers exploit logic errors or vulnerabilities within the login script itself to bypass authentication entirely. An exploit called XSS2Shell (CVE-2026-64638), discovered in August 2026 by pwn.ai, allows unauthenticated attackers to inject malicious JavaScript into the login page via a crafted username. By exploiting a parser differential between PHP’s strip_tags() and WordPress’s kses sanitizer, an attacker can chain this Cross-Site Scripting (XSS) flaw into Remote Code Execution (RCE) if an administrator interacts with a malicious link, effectively taking over the server without knowing the password.
- Themes and Plugins
WordPress is usually robust when it comes to security, but misconfigured or badly coded plugins and themes create a massive attack surface that often undermines this security.Plugins like Gravity SMTP (exploited in June 2026) have registered endpoints that allows attackers to query these endpoints to steal API keys, database credentials, and full system reports, which are then used to compromise connected services or plan deeper intrusions.
Vulnerabilities in plugins that hook into the login process (ex. CVE-2026-1492 in user registration plugins) can sometimes allow attackers to bypass wp-login.php entirely or forge authentication cookies.
How do we mitigate the attacks?
Our company Altometatron, as a hosting provider, also uses WordPress to power our clients’ websites. We trust WordPress because, while not perfect, it has withstood cyber attacks and has remained resilient. WordPress Core remains highly secure, with only 6 vulnerabilities reported in 2025, which is less than 1% of total ecosystem flaws. The primary challenges lie in the plugin ecosystem, which saw 11,334 new vulnerabilities in 2025. However, the platform’s ability to rapidly patch critical issues (like the recent wp2shell chain) demonstrates its commitment to safeguarding the ecosystem and its users. Despite these challenges, WordPress continues to power 41.2% of all websites globally, indicating sustained trust in its architecture when properly managed.
Everyday, bots probe and attack our websites:
We mitigate these attacks by deploying a layered defense beginning from the upstream with Cloudflare, down to the server infrastructure.
By placing Cloudflare at the edge, we are able to filter malicious traffic (DDoS, bad bots, SQL injection attempts) before it ever reaches our origin servers. We also use Cloudflare’s cache. This conserves server resources and blocks threats like the recent wp2shell and XSS2Shell exploits at the perimeter. It also automatically deploys emergency WAF rules for critical WordPress vulnerabilities.
If the attacker manages to pass through Cloudflare, the attacker is then filtered by Wordfence. This security plugin inspects traffic at the PHP level before it reaches the WordPress core. It protects sites by combining a Web Application Firewall (WAF), a malware scanner, and robust login security features to defend against threats like SQL injections, cross-site scripting, and brute force attacks. It uses the Threat Defense Feed to identify and block malicious traffic. It regularly scans core files, themes, and plugins against the official WordPress repository and over 44,000 known malware signatures to detect unauthorized changes or infections. It prevents unauthorized access by limiting login attempts to stop brute force attacks and blocking known malicious IP addresses. Wordfence also provides real-time visibility into who is accessing the site, allowing us to see exactly which IP addresses are attempting to break in or access sensitive areas, as well as observe its attack pattern. We use this data to further enhance our defenses.
Although Wordfence can block attackers, its running processes also cost us server resources. This can negatively affect our server and cause our hosted websites to lag or go down. To prevent this, we use a combination of applications that detect malicious IPs and use kernel-level firewalls to ban them. This method effectively prevents our server from responding to the hackers’ requests, causing their connection to ultimately fail.
Finally, we also secure the server itself by sealing unused ports and hardening our applications. This prevents hackers from penetrating our server, escalating their permissions, and taking over the entire server.
Clients get peace of mind
We proactively manage our clients’ security concerns, mitigating the risk of website breaches so they can operate with peace of mind. By handling the complexities of digital protection, we empower our clients to dedicate their full attention to growing their business.
We also provide comprehensive security solutions to clients using shared hosting or those who have their own VPS. Whether you are on a shared server or managing a private virtual environment, our defenses are tailored to your infrastructure. If you have any security issues or concerns, please feel free to contact us.