A serious content-injection vulnerability in the popular WordPress content management system, first discovered at the end of January, has been used to deface more than 1.9 million sites.

Seattle-based security firm WordFence Inc., which described it as “one of the worst WordPress related vulnerabilities to emerge in some time,” said in a blog post that the vulnerability had been used by hackers to post political messages in support of the Kurdish Peshmerga group fighting against both the Islamic State and the Turkish army in Northern Syria.

The hack uses a so-called unauthenticated privilege escalation vulnerability in a REST API endpoint that was introduced into WordPress versions 4.7 and 4.7.1. The new versions were intended to provide easier access to posts, comments, terms and other settings. Instead, the vulnerability resulted in a kind of “feeding frenzy where attackers are competing with each other to deface vulnerable WordPress websites,” said the company, which noted that so far it had tracked more than 20 different defacement campaigns.

WordPress.org, the company behind the open-source code, pushed a new patched version of the content management system on Jan. 26, but revealed the vulnerability Feb. 1 in an effort to encourage users to update their WordPress installs.

“We believe transparency is in the public’s best interest,”  said Aaron D. Campbell, a contributor to WordPress who works at GoDaddy. “It is our stance that security issues should always be disclosed. In this case, we intentionally delayed disclosing this issue by one week to ensure the safety of millions of additional WordPress sites.”

Security firm Securi warned separately that some hacker groups had since moved on from defacement and were now attempting to use the bug to hijack sites for their own ends. “Attackers are starting to think of ways to monetise this vulnerability,” Sucuri founder Daniel Cid explained in a blog post. “Defacements don’t offer economic returns, so that will likely die soon.”

Users are encouraged to immediately update all their WordPress installations if they have not done so already.

(Editors Note: An earlier version of the article said “Automattic Inc., the company behind WordPress, pushed a new patched version of the content management system.”  The note was actually from WordPress.org.)

Image: Wordfence/unknown creator