The problem, in plain terms
CVE-2026-87902 is a path traversal flaw in WordPress core: under the right conditions, someone with no account on your site can reach files they should never touch, and researchers have shown that path can lead to running code on the server. It affects every WordPress from 4.7.0 through 7.1.1, which is most WordPress sites that have not updated recently. It was fixed in WordPress 7.1.2 on September 22, 2026, with fixes backported to the older branches. CISA added it to the Known Exploited Vulnerabilities catalog on September 25, 2026, and exploitation attempts were observed within about a day of the technical details circulating, including attempts to plant webshells, the hidden backdoors attackers leave behind.
Unlike the PHP flaw, this one has a simple owner-level fix: updating WordPress core to the fixed release for your branch closes it. The catch is everything around that sentence. Owners believe updates are on when they are not, updates stall halfway, and nobody confirms the running build afterwards.
What the evidence can and cannot show
Most WordPress sites announce their version in their public pages, and the free check above reads that announcement. If your version is between 4.7.0 and 7.1.1, the honest statement is that your WordPress sits inside the CISA-listed exploited range. That is not proof your site has been attacked, and anyone who tells you a version number proves a compromise is selling you something. It means the flaw applies to your version and is being used against sites like yours. A version at or past the fixed release is outside this flaw's range. A site that hides its version cannot be cleared from outside; the full check confirms the exact build from the evidence you provide.
What the fix involves
The update itself is the small part, and it is the paid work, so the recipe stays off this page. The job around it is what you are buying: a confirmed full backup before anything changes, the core update applied to the fixed release for your branch, a check that themes and plugins survived, agreed checks on your homepage, forms, and checkout, and a written verification record showing the before and after versions. On sites where the update cannot run cleanly, the backup is restored and the next step is agreed in writing; a restoration is never sold as a completed fix. If your WordPress is older than 4.7, the job is a staged move to a current release, priced exactly in the written scope first.
What it costs
A core fix is Fix It, CA$197. If the check also proves an exposed PHP underneath or spoofable email, one Secure It job at CA$397 closes everything together, under the service terms.