Defacement attempts via REST API flaw over time (via Sucuri) Attackers are exploiting a vulnerability in the WordPress REST API, which the WordPress team fixed almost two weeks ago, but for which they published public details last Monday.