WARNING: MAJOR new WordPress vulnerability!!!
A very new major vulnerability affecting recent versions of WordPress, likely millions of running instances, is currently being massively exploited in the wild.
The exploit permits unauthenticated users to gain administrative access and control.
The typical pattern is that the exploit gains control, changes the administrator password, creates a number of additional administrators and attempts to access "xmlrpc.php" to morph the site into a malware, etc. distribution site.
If the xmlrpc.php is already blocked on the site, the exploit possibly may not proceed further immediately, but would still leave the additional new administrative users behind.
There are several mitigation techniques even if you are running a vulnerable site and cannot upgrade. The key points are to block the main exploit entry point, remove the additional administrative user entries, and ideally block remote access to the main WordPress login page itself.
More info including a test for vulnerability is at:
L
@lauren TL;DR: update your wordpress instance?
![inkorrupt [161]](https://dresden.s3proxy.de/accounts/avatars/109/864/602/204/743/338/original/ef714f74aeb2fd8c.png "inkorrupt [161]")
