What happened
In September 2026, the WordPress project fixed a serious flaw in WordPress core, the software that powers a large share of small business websites. The flaw is catalogued as CVE-2026-87902. It is a path traversal problem: with crafted requests, a visitor who has no account on your site can reach files outside the folders WordPress is meant to serve.
Under certain conditions, that reach can go further and become remote code execution, where the attacker runs their own code on your server. The conditions are specific. They involve a local PHP file the attacker is able to read, together with the way your theme is laid out. Many sites in the affected range may not meet those conditions. Being in the range is not proof that a site has been compromised, and this article will not pretend otherwise.
The range, and why it is taken seriously
The flaw affects WordPress versions from 4.7.0 to 7.1.1. It was fixed in version 7.1.2, released on September 22, 2026, and the WordPress project also backported the fix to older branches, so sites on maintained older versions have a fixed release available to them.
On September 25, 2026, the United States Cybersecurity and Infrastructure Security Agency, known as CISA, added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog. That catalog is reserved for flaws the agency treats as confirmed exploited in the wild, and it is why the careful wording matters: a WordPress version inside 4.7.0 to 7.1.1 is a version inside the CISA-listed exploited range. Researchers running honeypots, decoy servers left online to be attacked, recorded exploitation attempts within about a day of the flaw becoming public, including attempts to plant webshells, small hidden files that hand an attacker a reusable way back into a server.
What this means for your site
Attackers scan the web for version numbers because it is cheap to do, and because public flaws come with public instructions. A site announcing a version inside the exploited range is simply easier to sort into the target pile. That sorting is the risk you can remove. No scan of a version number can tell you whether a particular site has already been breached; that takes a different kind of examination, and any service that claims otherwise from a version alone is overstating what it knows.
The fix
Updating WordPress core to the fixed release for your branch closes this flaw. For a healthy site that is normally a short, routine job: take a backup, run the core update, and confirm the site and its forms still work afterwards. Sites that have avoided updates for years deserve a slower pass, because very old themes and plugins can break when the core moves a long way at once. Either way, the version your site announces afterwards is the evidence that the job is done.
Check where your site stands
The free checks on our homepage include a WordPress check that reads the version your site announces and compares it with the exploited range above. If your site announces no version, the check says that too, and our WordPress exposure page explains what an unproven version means and what the fix involves.
Technical references
This article is based on the WordPress project's release records and the CISA catalog entry. They are cited as references, not as endorsements of this service.
- WordPress project, version 7.1.2 security release notes, September 22, 2026
- CISA, Known Exploited Vulnerabilities catalog, entry for CVE-2026-87902, added September 25, 2026