Up to 20 attackers or groups of attackers are defacing WordPress websites that haven’t yet applied a recent patch for a critical vulnerability. The vulnerability, located in the platform’s REST API, allows unauthenticated attackers to modify the content of any post or page within a WordPress site. The flaw was fixed in WordPress 4.7.2, released on Jan. 26, but many webmasters did not apply the patch and a wave of attacks soon followed. The number of defaced pages has grown to over 1.5 million and there are 20 different attack signatures.”]