Have you ever wondered what threats your WordPress website might be facing? With millions of websites worldwide running on this platform, every discovered security vulnerability can turn into a true nightmare. And this time, WordPress has just released a patch for a vulnerability rated as critical – the highest level on the security scale.
I have spent 20 years tracking the endless battles between hackers and system defenders. Every time a vulnerability like this appears, I am reminded of the countless websites that have been compromised simply because of delayed updates. This time is no exception.
Vulnerability CVE-2026-87902: What is Threatening Your Website?
On September 22, 2026, WordPress released version 7.1.2 to patch an extremely dangerous vulnerability assigned the identifier CVE-2026-87902. What makes this vulnerability terrifying is not just its severity, but also the way it can be exploited.
According to assessments from the WordPress security team itself, this vulnerability received a 9.2 CVSS score – a figure almost reaching the ceiling of the danger scale. And the worst part is: an attacker does not need any account on your website, nor any action from a logged-in user, to exploit this vulnerability.
Imagine this: an attacker anywhere in the world, with just a cleverly crafted HTTP request, could cause your website to load a PHP file from outside the theme directory. And on certain servers, the next step could be remote code execution – meaning the attacker could run their own programs right on your server.
Who is Affected and the True Level of Danger
The scope of this vulnerability's impact is alarmingly wide. All WordPress versions from 4.7.0 to 7.1.1 are in the crosshairs. This means that even websites updated to version 7.1.1 just a few days prior – during the September 17 security release – still need to update once again.
This is a completely different vulnerability compared to those patched in the previous release. It is not a variant of the same issue, but rather an independent vulnerability requiring a separate patch.
However, one thing must be made clear to avoid excessive panic: this vulnerability does not mean every WordPress website can instantly suffer remote code execution. WordPress calls this a vulnerability that can lead to code execution on "certain servers" – and that word "certain" is key to understanding the actual level of risk.
Exploitation Mechanism: From Small Flaw to Disaster
To fully understand the danger, let us dissect the exploitation mechanism of this vulnerability.
The issue lies in how WordPress selects a template file for a page. One of the filenames it generates is constructed from a part of the web address. On affected versions, WordPress failed to pass that value through traversal checking mechanism ../ – a protective measure utilized by surrounding code blocks.
As a result, an attacker can take advantage of this to force the website to load a PHP file from outside the theme directory. But to turn that into malicious code execution, a second condition is required: the server must already contain a PHP file that, when loaded, performs an action useful to the attacker.
Security expert Robert Ressl – who discovered and privately reported this vulnerability through the WordPress HackerOne program in July – published a detailed analysis along with a proof of concept and independent testing lab. The attack he demonstrated runs code with the privileges of the web server account, rather than full control over the server. He also tested it on WordPress 7.0.2 in an isolated laboratory environment, not against the patched version or any live website.
Two Signs Indicating Your Website is at High Risk
Security firm Patchstack, in its independent analysis, pointed out two factors determining a website's exposure level to this vulnerability.
First, whether the active theme contains a top-level directory with a name starting with "page-". Some themes, including older default WordPress themes, contain such directories, while current default themes do not.
Second, whether PHP is running with the register_argc_argv configuration enabled. This is a setting that a known code execution technique relies upon. Notably, this setting is disabled by default in PHP 8.5 but enabled by default on older PHP versions.
Neither of these factors is a fix. They simply tell you how close your website is to the worst-case scenario. And if you are running an older PHP version with a theme containing a "page-" directory, you are in the highest risk zone.
Which Version Do You Need to Update To?
WordPress has released patches for all branches still supported by the project, dating all the way back to version 4.7. This was done as a courtesy to the community, but it also highlights the severity of the vulnerability.
Below is the corresponding update table for each branch:
| Branch You Are Running | Update To |
|---|---|
| 7.1.x | 7.1.2 |
| 7.0.x | 7.0.6 |
| 6.9.x | 6.9.9 |
| 6.8.x | 6.8.10 |
| 6.7.x | 6.7.9 |
| 6.6.x | 6.6.9 |
WordPress has backported patches to every older branch still supported by the project, down to version 4.7.37. The full list is available in the official release notes.
Websites with background automatic updates enabled will begin the update process without requiring your intervention. Other sites can update manually from the dashboard under the Updates section, or download the release directly from WordPress.org.
WordPress does not provide any workarounds other than updating. This is the only way to patch the vulnerability.
What If You Cannot Update Immediately?
I understand that in reality, you cannot always update immediately. You might be running a website with hundreds of plugins, and you worry that an update might cause conflicts. Or you might be in the middle of a critical campaign and want to avoid risks.
Robert Ressl provided some temporary risk mitigation measures for those who cannot update right away:
- Disable register_argc_argv for web requests. This is the setting that the code execution technique depends on. Disabling it will significantly reduce the likelihood of successful exploitation.
- Remove unused PEAR components. PEAR is an old PHP library, and its components can provide targets for attackers.
However, it must be stated clearly: neither of these measures fixes the underlying vulnerability. They only reduce the likelihood of exploitation, rather than completely eliminating the risk. The only way to be truly safe is to update to the patched version.
Active Exploitation Status: No Reports Yet, But Do Not Be Complacent
As of September 22, there have been no reports of this vulnerability being exploited in real-world attacks. It is also not listed in CISA's (Cybersecurity and Infrastructure Security Agency) Known Exploited Vulnerabilities catalog.
This is a positive sign, but absolutely not a reason for complacency. History has proven that critical vulnerabilities are often exploited en masse after details about them are publicly disclosed. When a vulnerability has a CVSS score of up to 9.2 and a proof of concept is available, it is only a matter of time before it becomes a target for automated attack campaigns.
Hard-Earned Lessons for Website Administrators
Through 20 years of witnessing numerous cyber attacks, I have distilled a few lessons that any WordPress website administrator should keep in mind.
1. Updating is Not Optional, It Is an Obligation
In the world of security, there is no room for delay. Every hour you delay updating is an hour your website exposes itself to the risk of compromise. Enable automatic updates for the WordPress core, and check your dashboard regularly to ensure everything is up to date.
2. Understand Your Server Configuration
This vulnerability is particularly dangerous on servers running older PHP versions with register_argc_argv enabled. If you do not know what configuration your server is running, contact your hosting provider today to find out. Do not remain in the dark about settings that could determine the fate of your website.
3. Diversify and Backup
Even if you have updated, always keep a full and recent backup. In the worst-case scenario, you can restore your website to a safe state before it was compromised. And do not forget to back up both the database and the files.
4. Follow Security Intelligence Sources
Vulnerability CVE-2026-87902 was discovered in July but only disclosed and patched in September. If you do not follow reputable security sources, you might have missed information about this critical patch for days. Subscribe to notifications from organizations like Patchstack, Wordfence, or WordPress itself.
Cybersecurity is a Journey, Not a Destination
WordPress patching a critical vulnerability this time is a reminder that no system is invulnerable. Even a platform trusted by millions like WordPress can harbor flaws that could be exploited for remote code execution.
The important thing is not whether a vulnerability exists – because it certainly always will. The important thing is how fast you react when it is discovered. In the endless war between hackers and system defenders, speed is the decisive factor.
Update today. Do not wait until tomorrow, because tomorrow might be too late.
Have you ever faced a cyber attack targeting your website? If so, how did you detect and handle it? If not, what plans do you have to protect your website against critical vulnerabilities like CVE-2026-87902? Share your story and strategy below, because in the field of cybersecurity, shared knowledge is multiplied knowledge!
0 Comment
Add your comment to this article