Wordfence researchers indicate that in the last few days, they have spotted a significant series of attacks emerging from 16,000 IP addresses and targeting over 1.6 million WordPress websites. 

Four WordPress plugins including fifteen Epsilon Framework themes are targeted by the malicious attackers, one of which has no patch available. Some of the vulnerable plugins have been fixed recently as of this week, while others were updated as recently as 2018. 

The affected plugins and their versions are: 

The targeted Epsilon Framework themes are: 

"In most cases, the attackers are updating the users_can_register option to enabled and setting the default_role option to administrator," Wordfence explains. "This makes it possible for attackers to register on any site as an administrator effectively taking over the site." 

To see if one's site has already been infiltrated, one should go through all user accounts and search for any unauthorized modifications that need to be removed right away. 

Next, go over to "http://examplesite[.]com/wp-admin/options-general.php" and look through the Membership as well as the new user default role settings. Even if the plugins and themes aren't on the list, it's a good idea to upgrade them as soon as possible. If one is using NatureMag Lite, which has no solution, then they should uninstall it right away. 

It is critical to note that upgrading the plugins would not remove the threat if the site has already been hacked. In this scenario, it is recommended that first follow the methods provided in detailed clean-up manuals. In general, one must aim to minimize the number of plugins on the WordPress site to a bare minimum, as this significantly reduces the possibility of being attacked and hacked in the first place.