200,000+ WordPress Sites at Risk of Hacking Due to Unauthenticated RCE Vulnerabilities

A critical security flaw affecting a widely used WordPress plugin has been identified, exposing more than 200,000 websites to potential takeover by malicious actors.

Critical Security Flaw Identified

The vulnerabilities, tracked as CVE-2026-78159 and CVE-2026-78006, allow attackers to execute arbitrary code remotely without requiring authentication, leading to complete compromise of affected installations. The affected plugin, which has over 600,000 active installations, is vulnerable in all versions prior to 6.17.3.1.

Vulnerabilities Overview

The first flaw, CVE-2026-78159, stems from inadequate input validation that enables unauthenticated code injection. Attackers can exploit this by delivering a specially crafted payload during the processing of single-tenant requests, bypassing existing security checks. The second vulnerability, CVE-2026-78006, involves an unauthenticated PHP object injection flaw tied to comment handling. This occurs when an unauthorized user submits a comment that triggers a vulnerable function before moderation, allowing execution of malicious code.

CVE-2026-78159: Input Validation Flaw

Both vulnerabilities independently enable remote code execution, granting adversaries full control over affected WordPress sites.

CVE-2026-78006: PHP Object Injection Flaw

The plugin’s developers, StellarWP, addressed the second issue in a subsequent update, but the first remains active in older versions.

Developer Response and Patch Status

Security researchers note that exploitation of these flaws requires comment functionality to be enabled, limiting the immediate risk but still posing a significant threat to affected users. Data from WordPress indicates that approximately 240,000 websites utilize the plugin, though the exact number of vulnerable installations remains unclear.

Security Implications and Recommendations

The vulnerabilities were disclosed following a period of heightened activity between September 10 and 14, though no confirmed attacks have been reported as of the latest analysis. The discovery underscores the risks associated with outdated plugins and the importance of timely updates. Organizations relying on the affected software are advised to upgrade immediately to mitigate exposure.

Security firms have emphasized that unpatched systems remain prime targets for exploitation, particularly given the high CVSS scores of both vulnerabilities (9.8 out of 10). The incident adds to a growing list of critical flaws impacting enterprise infrastructure, including recent disclosures involving cPanel, WSO2, and Apple products.

Cybersecurity professionals are urging administrators to review their plugin configurations and implement strict update policies to prevent similar threats.