WordPress released version 7.1.2 on 22 September to fix a critical vulnerability in its core. Attackers began probing websites for it within hours. If your site runs WordPress, this update should not wait for the next scheduled maintenance.
What happened?
The vulnerability is tracked as CVE-2026-87902. The WordPress security team rates it 9.2 out of 10 (CVSS v4.0). It sits in WordPress’s own code, not in a plugin, and affects every version from 4.7.0 to 7.1.1.
In plain terms, an attacker who is not logged in can make WordPress load a different PHP file that already exists on the server. Under the right conditions, that lets an outsider run their own code on your server and take over the website.
How fast did the attacks start?
The security company Patchstack saw the first attempts on its firewall on the same day the fix was published. That same day it recorded the first attempt to write a file to a server. Most of the files written were harmless test files, but others were built to run commands on the server.
On 23 September public scanning tools appeared, and Patchstack says the volume of attack traffic grew to more than ten times that of the first evening. BleepingComputer reported the same day that exploitation had started.
Patchstack’s view is simple: updating is still the answer, and now that attackers are writing files to servers, it is urgent.
Is your website at risk?
Every WordPress site on a version between 4.7.0 and 7.1.1 that has not yet received the 22 September fix is vulnerable. For an attacker to run code, the advisory says two more things have to be true:
- The theme. The active theme has a folder whose name begins with “page-”. The advisory names the older default themes Twenty Twelve and Twenty Fourteen, and the third-party themes Neve, Hestia and Sydney.
- The server. A PHP add-on called PEAR is installed, with a setting that lets it be abused. According to the advisory, this is the case in the official PHP Docker image and in cPanel’s default configuration with PHP older than 8.5.
Most business owners will not know these details about their own site, and they do not need to. An unpatched site has not necessarily been broken into. But updating takes less time than finding out whether both conditions apply.
How do you check your WordPress version?
The version is shown on the Updates page of the WordPress dashboard. A patched site shows 7.1.2, or the fix for its older version line, such as 6.9.9. If you do not have access, a short email to whoever built or maintains the site will get you the answer.
What to do now
- Update WordPress today. The current version is 7.1.2. Older version lines received their own fixes on the same day, such as 6.9.9 and 6.8.10. Versions 4.6 and older get no fix.
- Turn on automatic security updates. WordPress can install minor security releases by itself, so the next critical fix does not depend on someone remembering.
- Ask your hosting provider to review the server settings. Patchstack recommends disabling the PHP setting
register_argc_argv, which breaks the attack chain seen so far. It does not replace the update. - Have your IT partner check the logs and files. Requests with
%2e%2ein the page name parameter are suspicious. Patchstack says any unexpected PHP file in the server’s temporary folders should be treated as a sign of compromise. - If you find signs of a break-in, do not stop at updating. The update closes the door but does not remove files an attacker has already left behind. A break-in can be reported to CERT-EE, Estonia’s national computer emergency response team, at cert@cert.ee. Our incident page lists the first steps.
New critical vulnerabilities appear all the time, and attackers move quickly. With monthly monitoring, we tell you on the same day when a critical threat affects your site.
Sources
- WordPress (GitHub): Path traversal in page template resolution, GHSA-7hp8-65ch-5whp
- Patchstack: CVE-2026-87902 – Attackers Started Probing WordPress Sites Hours After the Patch
- BleepingComputer: Hackers start exploiting critical WordPress flaw for code execution
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
