Hackers have exploited a critical vulnerability in the WordPress theme 'Motors', allowing them to hijack administrator accounts and gain full control of targeted sites. The flaw, tracked as CVE-2025-4322, was discovered in May 2025 and affects versions before and including 5.6.67. Despite a patch being released, many users failed to update, leading to widespread exploitation. Wordfence reported blocking 23,100 attempts against its customers by June 2025. The attackers reset administrator passwords and created new admin accounts for persistence, locking out existing administrators and compromising site security.