Critical WordPress flaw attacked within hours of the patch

On September 22, WordPress released version 7.1.2 to fix a single security flaw in its core, tracked as CVE-2026-87902. Exploiting it doesn't require logging in, and attacks started the same day. If your website runs on WordPress, check which version it's on today.

What happened

The flaw sits in the part of WordPress that decides which page template to display. An attacker with no account on the site can trick it into loading a PHP file from outside the theme folder. On certain server setups, that leads to remote code execution: the attacker can run their own commands on your server.

• Affected versions: every release from 4.7.0 through 7.1.1.
• Fixed versions: 7.1.2, plus equivalent patches for older branches (7.0.6, 6.9.9, 6.8.10 and so on down to 4.7.37). Versions 4.6 and earlier no longer receive patches.
• Severity: WordPress's advisory rates it critical (9.2 out of 10). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of actively exploited vulnerabilities on September 25.

Security firm CrowdSec saw the first attack attempt within hours of the patch going out, and by September 28 it had logged more than 30,000 distinct IP addresses probing for the flaw. It's a familiar pattern: attackers study the patch to learn exactly what to target, then go after every site that hasn't updated yet.

What it means for your business

Full remote code execution isn't possible on every server: it needs a specific combination of PHP and theme configuration. That's not a reason to wait, for two reasons:

1. You don't know how your server is configured unless you've checked. Many shared hosting plans use default settings that meet some of those conditions.
2. The attacks are automated. Nobody picks your site by hand: bots sweep the internet for any WordPress install that hasn't been updated. A small business is as much a target as a large one.

A compromised site can end up redirecting your customers to scam pages, sending spam from your domain, or getting flagged as dangerous by Google, with the drop in traffic and trust that follows.

What we recommend

1. Check your version now. In the WordPress dashboard, go to Dashboard → Updates. You should see 7.1.2 or the patched version for your branch.
2. If it isn't updated, update today. WordPress installs minor security releases automatically by default, but many sites have that turned off or leave it to the hosting provider. Don't assume it's done.
3. Take a backup first, in case an older plugin misbehaves after the update.
4. If you're on a version older than 4.7, migrate. It no longer gets patches and will stay exposed to this and future flaws.
5. Look for suspicious activity since September 22: admin users you don't recognize, new PHP files, or content you didn't change.

In short

This is a serious flaw that's easy to attack and is already being exploited at scale. The fix is simple: update WordPress. If you're not sure how, or whether your site is affected, get in touch and we'll check it with you.