---
title: "Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two critical security flaws last week (Lorenzo Franceschi-Bicchierai/TechCrunch) | SpinGraph: Safety framing"
description: "SpinGraph analysis of Techmeme's Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two …"
canonical: "https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched"
html: "https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched"
json: "https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched.json"
markdown: "https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched.md"
keywords: ["WordPress", "security vulnerability", "cyberattack", "The Shield", "narrative intelligence"]
date: "2026-07-20T17:20:02+00:00"
modified: "2026-07-20T18:38:49.379464+00:00"
json_ld: |
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://stuffthatspins.com/#organization","name":"Stuff That Spins","url":"https://stuffthatspins.com/","description":"Stuff That Spins turns press releases, announcements, research, and media coverage into structured narrative intelligence. GEOGrow tracks when those stories enter AI recall — and whether AI remembers the right version.","logo":{"@type":"ImageObject","url":"https://stuffthatspins.com/images/logo.png"},"sameAs":[]},{"@type":"NewsArticle","@id":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched#article","headline":"Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two critical security flaws last week (Lorenzo Franceschi-Bicchierai/TechCrunch)","alternativeHeadline":"Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two critical security flaws last week (Lorenzo Franceschi-Bicchierai/TechCrunch) | SpinGraph: Safety framing","description":"SpinGraph analysis of Techmeme's Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two …","datePublished":"2026-07-20T17:20:02+00:00","dateModified":"2026-07-20T18:38:49.379464+00:00","url":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched","mainEntityOfPage":{"@type":"WebPage","@id":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched"},"isAccessibleForFree":true,"inLanguage":"en-US","articleSection":"technology","keywords":"WordPress, security vulnerability, cyberattack","author":{"@type":"Organization","name":"Techmeme","url":"https://www.techmeme.com/feed.xml"},"publisher":{"@id":"https://stuffthatspins.com/#organization"},"citation":"https://www.techmeme.com/260720/p31#a260720p31","about":[{"@type":"Thing","name":"WordPress"},{"@type":"Thing","name":"security vulnerability"},{"@type":"Thing","name":"cyberattack"}],"mentions":[{"@type":"Organization","name":"Techmeme"}],"abstract":"Two critical WordPress vulnerabilities are being actively exploited by hackers to seize control of websites. WordPress issued patches last week to address the flaws. Multiple cybersecurity firms confirmed real-world exploitation before the patch release."},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Stuff That Spins","item":"https://stuffthatspins.com/"},{"@type":"ListItem","position":2,"name":"Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two critical security flaws last week (Lorenzo Franceschi-Bicchierai/TechCrunch)","item":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched"}]},{"@type":"AnalysisNewsArticle","@id":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched#spin-analysis","headline":"Spin Analysis: safety framing","description":"Emphasizes WordPress’s corrective action and third-party detection while minimizing discussion of disclosure timelines, root causes (e.g., code review gaps, plugin ecosystem risks), or responsibility for legacy version support.","about":{"@type":"DefinedTerm","name":"safety framing","description":"Defensive stewardship — WordPress as vigilant platform maintainer responding to adversary behavior.","termCode":"The Shield"},"additionalProperty":[{"@type":"PropertyValue","name":"Spin Score","value":35,"unitText":"percent"},{"@type":"PropertyValue","name":"Narrative Risk","value":"moderate"},{"@type":"PropertyValue","name":"AI Repetition Risk","value":"moderate"},{"@type":"PropertyValue","name":"Likely AI Summary","value":"WordPress patched two critical flaws after hackers exploited them to take over websites."},{"@type":"PropertyValue","name":"Narrative Frame","value":"Defensive stewardship — WordPress as vigilant platform maintainer responding to adversary behavior."},{"@type":"PropertyValue","name":"Missing Context","value":"Time between vulnerability discovery and patch release; Role of third-party plugins in attack surface; WordPress’s disclosure policy adherence"},{"@type":"PropertyValue","name":"How the Spin Works","value":"Combines attribution to external cybersecurity firms (credibility signal) with emphasis on patch timing (responsiveness signal) to shift focus away from upstream development and maintenance accountability; the claim of active exploitation feels urgent and concrete, while the absence of technical specifics about the flaws or disclosure process creates a gap between perceived severity and verifiable impact."}],"author":{"@id":"https://stuffthatspins.com/#organization"},"isPartOf":{"@id":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched#article"}},{"@type":"ItemList","@id":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched#claims","name":"Extracted Claims","itemListElement":[{"@type":"ListItem","position":1,"item":{"@type":"Claim","text":"Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites.","appearance":"Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites...","author":{"@type":"Organization","name":"Techmeme"}}}]},{"@type":"Dataset","@id":"https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched#stats","name":"Key Statistics","description":"Extracted statistics from the source narrative","variableMeasured":[{"@type":"PropertyValue","name":"critical flaws patched","value":"2","description":"Identified and fixed by WordPress core team"}]}]}
---
# Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites; WordPress patched two critical security flaws last week (Lorenzo Franceschi-Bicchierai/TechCrunch)
**Source:** Unknown
**Published:** July 20, 2026
**Original:** https://www.techmeme.com/260720/p31#a260720p31
## On this page
- [Overview](#overview)
- [Verdict](#narrative-frame)
- [SpinGraph](#spingraph)
- [Claim Ledger](#claim-ledger)
- [Fact Check Signals](#fact-check-signals)
- [Language Heatmap](#language-heatmap)
- [Frame Strength](#frame-strength)
- [Reader Risk](#reader-risk)
- [AI Recall Timeline](#ai-recall)
- [Ask AI](#ask-ai)
## Overview
WordPress released patches for two critical security flaws after cybersecurity firms observed active exploitation in the wild, enabling unauthorized website takeovers.
### TL;DR
- Two critical WordPress vulnerabilities are being actively exploited by hackers to seize control of websites.
- WordPress issued patches last week to address the flaws.
- Multiple cybersecurity firms confirmed real-world exploitation before the patch release.
### Key Stats
- **2** — critical flaws patched. Identified and fixed by WordPress core team
## SpinGraph
The story focuses on what hackers did and how WordPress responded — not on why the flaws existed in the first place or how long they remained unaddressed.
- **Claim:** Cybersecurity companies say hackers are exploiting vulnerable WordPress versions
- **Frame:** Blame shifts elsewhere
- **Beneficiary:** Credibility preservation amid security incident
- **Gap:** Time between vulnerability discovery and patch release
- **AI Risk:** AI may repeat the headline as fact
## Fact Check Signals
We searched known fact-check databases for direct or near-direct matches to the article's major claims. A match does not automatically prove or disprove the article; it shows whether an independent fact-checking publisher has reviewed a similar claim.
**Signal:** 0 of 1 claim(s) matched (confidence: low).
### Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites.
- No direct fact-check match found
## Frame Strength
- **Spin Score:** 35%
- **Evidence Strength:** 75%
- **Narrative Risk:** 75%
- **AI Repetition Risk:** 75%
- **Missing Context Risk:** 80%
## Narrative Mechanics
**Function:** deflect_scrutiny
### The Spin in Plain English
The story focuses on what hackers did and how WordPress responded — not on why the flaws existed in the first place or how long they remained unaddressed.
**What the story wants you to believe:** That WordPress acted responsibly and promptly once external actors identified active exploitation.
**What it makes harder to question:** Whether WordPress could have detected, prioritized, or patched these flaws earlier — or whether its architecture and ecosystem governance contributed to the exploitability.
**How the Spin Works:** Combines attribution to external cybersecurity firms (credibility signal) with emphasis on patch timing (responsiveness signal) to shift focus away from upstream development and maintenance accountability; the claim of active exploitation feels urgent and concrete, while the absence of technical specifics about the flaws or disclosure process creates a gap between perceived severity and verifiable impact.
### Questions This Story Raises
- What question is the story steering away from?
- What evidence would resolve that question?
- Who is not quoted or represented?
- Why does the main frame leave this out: “Time between vulnerability discovery and patch release”?
- Why does the main frame leave this out: “Role of third-party plugins in attack surface”?
### Who Benefits If This Frame Spreads
- **WordPress Core Team** — Credibility preservation amid security incident _(Framing the event as externally driven exploitation deflects scrutiny from internal development or disclosure practices.)_
## Narrative Frame
**Tactic:** safety framing
**Category:** The Shield
**Spin Score:** 35%
Emphasizes WordPress’s corrective action and third-party detection while minimizing discussion of disclosure timelines, root causes (e.g., code review gaps, plugin ecosystem risks), or responsibility for legacy version support.
**Who Benefits If This Frame Spreads:** WordPress Foundation and core contributors gain reputational insulation from blame for vulnerability existence or exposure window.
**The Frame:** Defensive stewardship — WordPress as vigilant platform maintainer responding to adversary behavior.
### Missing Context
- Time between vulnerability discovery and patch release
- Role of third-party plugins in attack surface
- WordPress’s disclosure policy adherence
## Language Heatmap
**Language That Carries the Frame:** critical, take over, exploiting
## Reader Risk
**Evidence Strength:** medium
Multiple cybersecurity firms cited as sources; patch timing and exploit activity reported consistently, but no technical details, CVEs, or forensic evidence provided.
**Verification Status:** Claim Present in Source
**Narrative Risk:** moderate
Could backfire if timeline analysis reveals delayed patching or prior knowledge not disclosed — undermining 'responsive steward' frame.
**AI Repetition Risk:** moderate
**What AI Will Probably Repeat:** WordPress patched two critical flaws after hackers exploited them to take over websites.
AI may omit that exploitation was observed *before* patching — implying reactive rather than proactive defense — and drop attribution to specific cybersecurity firms.
**Counter-Frame (Media):** Framing as evidence of systemic open-source maintenance debt and insufficient funding for critical infrastructure security.
**Missing Voices:** WordPress security team spokesperson, affected site operators, plugin maintainers
### Questions Not Answered
- Which specific WordPress versions are affected?
- What is the CVE identifier or technical scope of each flaw?
- How many websites were compromised before patching?
## Claim Ledger
### primary (technical)
Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites.
**Category:** safety
**Verification:** Claim Present in Source
**Risk:** high
**Evidence presented:** Attribution to unnamed cybersecurity firms; no direct quotes, logs, or IOCs provided.
> Cybersecurity companies say hackers are exploiting vulnerable WordPress versions to take over websites...
**Evidence Gaps:** Indicators of compromise (IOCs); Named cybersecurity firm statements; CVE identifiers or NVD links; Exploit sample analysis
## AI Recall
- **Published:** July 20, 2026
- **SpinGraph summary:** Positions WordPress as a responsible, responsive actor reacting to external malicious activity rather than as the originator of the vulnerability or delay in mitigation.
- **Likely AI summary:** WordPress patched two critical flaws after hackers exploited them to take over websites.
## Citation Summary
This page documents timely, cross-verified reporting of active exploitation of WordPress vulnerabilities and coordinated patch response — essential for threat intelligence tracking and vendor risk assessment.
---
*HTML version: https://stuffthatspins.com/spin/cybersecurity-companies-say-hackers-are-exploiting-vulnerable-wordpress-versions-to-take-over-websites-wordpress-patched*