Active exploitation of critically vulnerable WordPress Motors theme
Take action: If you are running Motors theme on your Wordpress, update IMMEDIATELY! Your site is vulnerable and hackers are attacking it. Don't delay this one, it urgent and important!
Learn More
WordPress websites using the popular "Motors" automotive theme are under active attack following the disclosure of a critical privilege escalation vulnerability that allows unauthenticated attackers to hijack administrator accounts and gain complete control of targeted sites.
The exploited flaw is tracked as CVE-2025-4322 (CVSS score 9.8) is caused by the theme not properly validating a user's identity prior to updating their password, making it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators.
Following the public disclosure on May 19, threat actors began targeting vulnerable sites almost immediately, with mass exploitation observed beginning on June 7th, 2025. Since then, the Wordfence Firewall has blocked over 23,100 exploit attempts.
Common attacker-set passwords observed during attacks include:
- Testtest123!@#
- rzkkd$SP3znjrn
- Kurd@Kurd12123
- owm9cpXHAZTk
- db250WJUNEiG
Once access is gained, the attackers log into the WordPress dashboard as administrators and create new admin accounts for persistence. Website administrators should watch for sudden appearance of new administrator accounts combined with existing administrators being locked out, as these are signs of CVE-2025-4322 exploitation.
Website administrators using the Motors theme should immediately update to version 5.6.68 or newer and review logs for evidence of unauthorized password changes and unauthorized access.
