Estonia’s Information System Authority (RIA) recorded 964 cyber incidents with impact in September, slightly below the average for the previous six months. If your website runs on WordPress, the first thing to check is that it has been updated to version 7.1.2 or to the latest security release for its branch. The month’s other business-relevant items are DDoS attacks on Estonian websites and repeated failures of the state login services.
How serious are the WordPress vulnerabilities?
In September RIA warned on its blog about critical vulnerabilities in WordPress. In the worst case an attacker can take full control of a website. The main flaw is CVE-2026-87902, rated 9.2 out of 10 by the WordPress security team (CVSS v4.0).
The fix is to update WordPress to version 7.1.2 or later. RIA notes that sites on older version branches, such as 6.x, should have the latest security release for their branch. It also recommends switching on automatic security updates and removing unused themes, plugins and user accounts.
What is a DDoS attack, and does it affect small businesses?
In a distributed denial-of-service (DDoS) attack, a website or service is flooded with so many requests that it slows down or stops responding. In early September, attackers targeted Estonian websites in banking, healthcare, energy, transport and water supply, as well as government and political party sites. They cited the presidential election on 2 September and Estonia’s support for Ukraine. The attacks were relatively small and had no significant impact.
On 11 September, between 11:12 and 12:15, the state authentication service TARA was attacked. It received more than 86 million requests, over a hundred times its usual load. Protective measures blocked more than 90% of them, but there were short outages and slowdowns until 11:57. RIA analyst Dorel Kiik said September’s incidents showed that attack volumes can be very large.
Why could people not log in to state e-services?
According to RIA’s overview, the state single sign-on service GovSSO failed four times in September: on 21, 24, 28 and 29 September. The failures lasted from 27 minutes to an hour and a half. During them, people could not log in to several e-services, including the health portal, the Tax and Customs Board and the Transport Administration.
The root cause is still being analysed. On 1 October, RIA communications specialist Bret-Maria Rikko told ERR that the causes differed: the failures on 21 and 24 September were technical, and one case was a DDoS attack.
What else happened in September?
RIA counted 628 phishing sites in September, up from 506 in August according to its Estonian-language overview. Phishing sites make up most of the incidents registered by CERT-EE.
The overview also covers the data leak at Innovaatik, which runs an information system for dental care providers. We wrote about it separately, including what to ask your own software supplier.
Initial information suggests the University of Tartu’s online bookshop was broken into through an unpatched vulnerability. The university found out on 11 September and closed the shop. The attackers probably obtained customer data.
What to do now
- Update WordPress now. Ask whoever runs your website to install version 7.1.2 or later and to update themes and plugins as well.
- Agree who is responsible for updates. The University of Tartu bookshop shows how an unpatched flaw can leak an online shop’s customer data.
- Ask your hosting provider how your website is protected against DDoS attacks. RIA says well-designed defences blocked most of the malicious traffic aimed at TARA.
- Don’t leave deadlines to the last hour. If a return or application has to be filed through a state e-service, do it early: logging in may be unavailable for up to an hour or two.
If you want to know whether your website is up to date, our security check can tell you.
Sources
- RIA: September in cyberspace: data breaches and disruptions to government e-services
- RIA: Olukord küberruumis – september 2026
- RIA blog: Kriitilised turvanõrkused WordPressis: uuenda tarkvara esimesel võimalusel
- WordPress: security advisory GHSA-7hp8-65ch-5whp (CVE-2026-87902)
- ERR: Riigi autentimisteenustes on viimastel nädalatel esinenud korduvalt tõrkeid
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
