Hackers have launched a massive campaign against WordPress websites over the past weekend, attacking old vulnerabilities in unpatched plugins to download configuration files from WordPress sites.
The goal of the attack was to use old exploits to download or export wp-config.php files from unpatched websites, extract database credentials, and then use the usernames and passwords to take over databases.
Ram Gall, a threat analyst at Wordfence, a provider of web application firewall (WAF) services, said that last weekend's attack was of massive proportions when compared to what the company was seeing on a daily basis.
Gall said "this campaign accounted for 75% of all attempted exploits of plugin and theme vulnerabilities across the WordPress ecosystem."
Gall said Wordfence blocked more than 130 million exploitation attempts on its network alone, which targeted more than 1.3 million WordPress sites, however, the attacks are believed to have targeted even many more other sites, not covered by the company's network.
The Wordfence engineer said the attacks were carried out from a network of 20,000 different IP addresses. Most of these IPs were also previously used in another large-scale campaign that targeted WordPress sites at the start of May.