A popular WordPress theme has been hijacked by malware - here's what we know

'Motors' WordPress theme vulnerability leaves accounts open to takeover attacksWidespread attacks were observed from June 7 onwardsA patch is available in version 5.6.68, so update nowA popular premium WordPress theme, has been exploited by hackers thanks to a critical privilege escalation flaw tracked as CVE-2025-4322.Attackers are able to exploit the vulnerability in the 'Motors' theme to hijack administrator accounts, taking full control of sites to change details, inject false details and spread malicious payloads.Developed by StylemixThemes and a popular pick among automotive websites, nearly 22,500 sales of the theme have been logged on EnvatoMarket.'Motors' WordPress theme has been hijackedThe vulnerability had first been discovered on May 2, 2025, with a patch later released with version 5.6.68 on May 14, meaning that up-to-date accounts should be protected from potential account takeovers. Versions up to 5.6.67 are affected by the CVE, with Wordfence reporting on the details on May 19."This is due to the theme not properly validating a user's identity prior to updating their password," Wordfence explained."This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account."Although the patch has already been released, accounts that are still running older versions are at risk of takeover, with attacks seen to have started on May 20. By June 7, researchers were observing wide-scale attacks – Wordfence has now blocked more than 23,000 attack attempts.Wordfence also disclosed a number of key IP addresses seen to be attacking sites – many making thousands of attempts each."One obvious sign of infection is if a site’s administrator is unable to log in with the correct password as it may have been changed as a result of this vulnerability," the researchers explained.The biggest change users of the 'Motors' theme can do is to update to version 5.6.68, closing the vulnerability to attackers and securing their accounts from takeovers.Via BleepingComputerYou might also likeWe've listed the best firewall softwareCritical security flaw could leave over 100,000 WordPress sites at riskKeep track of your multi-factor authentication codes with the best authenticator apps