Attackers began probing WordPress sites for a critical remote code execution flaw within hours of its public disclosure this week, according to The Hacker News. The vulnerability, tracked as CVE-2026-87902, sits inside WordPress Core’s page-template resolution system, and both Patchstack’s September 2026 analysis and the HackerOne disclosure record CVE.org published that same month confirm it requires zero authentication to trigger, meaning an attacker needs no account and no login at all. Security firm Patchstack recorded the first exploitation attempt at 11:49 UTC on September 22, 2026, the same day WordPress shipped version 7.1.2, the fix Patchstack credits with closing the hole, along with a wave of backported patches to older branches.
The speed of the attack is the story here. A patch landed, and within roughly the same day, automated scanners were already probing live sites for the hole it closed. That pattern has become routine for WordPress, the content management system that still runs a huge share of the public web, and it is exactly why security teams keep pushing “patch immediately, not eventually” as the only real defense against a CMS this widely deployed.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CVE-2026-87902 actually is
CVE-2026-87902 is classified under CWE-98, improper control of a filename used in an include statement, according to the official WordPress advisory published alongside the 7.1.2 release. WordPress rated the bug critical, with a CVSS 4.0 score of 9.2, per the WordPress.org release announcement, and NVD’s own September 2026 scoring update independently arrived at the same 9.2 Critical rating, with NVD’s listing specifying that every WordPress version below 7.1.2 is affected. The flaw lives in how WordPress Core resolves page templates. Under certain server and theme conditions, an unauthenticated attacker can force that resolution logic to include a readable local PHP file sitting outside the active theme’s directories.
On its own, that is a local file inclusion (LFI) bug. But LFI issues in PHP applications are rarely just LFI. If an attacker can get WordPress to pull in an arbitrary file they control or partially control, and the server configuration allows it, that file inclusion can be escalated into full remote code execution. Security researcher Robert Ressl is credited with the responsible disclosure in the official advisory, and the HackerOne disclosure record CVE.org published in September 2026 likewise confirms the flaw demands no authentication whatsoever. Red Hat’s own September 2026 advisory echoed the same concern, noting that remote code execution becomes possible once specific server and theme prerequisites align. WordPress.org’s writeup frames the risk plainly: under the right conditions, this is a path from an anonymous HTTP request to code running on the server.
What makes this bug different from a typical plugin vulnerability is where it lives. This is not a third-party plugin or a niche theme. It is WordPress Core itself, the code that ships with every single install regardless of which plugins a site owner has chosen. That is also why the patch touched so many historical branches at once: WordPress doesn’t just fix the current release when a Core bug this severe surfaces, it backports the fix all the way down its supported version tree.
Timeline: from patch to probing in hours
The sequence of events, pieced together from WordPress.org, Patchstack, and The Hacker News reporting, looks like this:
| Date / Time (UTC) | Event | Source |
|---|---|---|
| September 22, 2026 | WordPress releases version 7.1.2 and backports the CVE-2026-87902 fix to 13 older branches | WordPress.org |
| September 22, 2026, 11:49 UTC | Patchstack’s firewall records the first exploitation attempt against the flaw | Patchstack |
| September 22, 2026 (earlier report) | The Hacker News notes the bug was not yet listed in CISA’s Known Exploited Vulnerabilities catalog and no public attacks had been confirmed at that point | The Hacker News |
| September 24, 2026 | The Hacker News reports attackers are actively exploiting the vulnerability in the wild | The Hacker News |
That gap between “patch released” and “first probing attempt recorded” is measured in hours, not days. This is now the default rhythm for high-severity WordPress Core bugs: the patch itself, once public, becomes the blueprint attackers reverse-engineer to build their scanning payloads. Diffing a patched file against the prior release tells an attacker exactly what changed and exactly what input triggers the bug. That is why security teams increasingly argue that the disclosure of a patch is the actual start of the race, not the end of it.
Which WordPress versions are affected
According to WordPress.org, every release from 4.7.0 through 7.1.1 is affected unless the site has already applied the relevant security backport, a range Patchstack independently confirmed in its own September 2026 advisory. That is an unusually wide span, covering roughly a decade of WordPress Core releases. The fixed version is 7.1.2, and WordPress also backported the patch to the following branches, a rollout that downstream Linux distributions are still working through: Debian marked its WordPress 6.8.10 package fixed in October 2026, while the 6.8.7 package it had been shipping remained vulnerable up to that point.
| Branch | Patched version |
|---|---|
| Current | 7.1.2 |
| 7.0.x | 7.0.6 |
| 6.9.x | 6.9.9 |
| 6.8.x | 6.8.10 |
| 6.7.x | 6.7.9 |
| 6.6.x | 6.6.9 |
| 6.5.x | 6.5.12 |
| 6.4.x | 6.4.12 |
| 6.3.x | 6.3.12 |
| 6.2.x | 6.2.13 |
| 5.1.x | 5.1.26 |
| 5.0.x | 5.0.29 |
| 4.9.x | 4.9.33 |
| 4.8.x | 4.8.32 |
| 4.7.x | 4.7.37 |
WordPress.org has not published a precise count of how many live sites remain unpatched, and neither has any outlet covering the story as of this writing. Given that WordPress powers a large share of all websites globally, even a modest percentage of unpatched installs represents a substantial attack surface, a point SecurityWeek’s reporting on the release also underscored. Sites that rely on automatic background updates, a WordPress default for minor and security releases, should already be running 7.1.2 or the appropriate backported version. Sites on managed hosting, locked to a specific version for compatibility reasons, or running heavily customized Core forks are the ones most likely to still be exposed.
Why this bug moved so fast from patch to exploitation
WordPress’s own update infrastructure is, ironically, part of why attacks start so quickly. The moment a security release goes out, the patched code becomes public. Security researchers, penetration testers, and attackers alike can pull the diff between 7.1.1 and 7.1.2, see exactly which lines of code changed in the template-resolution logic, and infer the vulnerable input pattern. This is standard practice across the industry (it’s how Patchstack itself builds detection rules) but it cuts both ways: the same diff that helps defenders write a firewall rule helps an attacker write a scanner.
Patchstack’s telemetry, drawn from its network of WordPress firewalls, is what caught the first exploitation attempt at 11:49 UTC on September 22. That is a detection based on live traffic hitting real, monitored sites, not a lab proof-of-concept. It tells you attackers had a working exploit path built and were already testing it against production WordPress installs on the same calendar day the patch shipped.
This mirrors a pattern that has shown up repeatedly across the CMS and enterprise software landscape this year. Citrix NetScaler’s most recent CISA-flagged bug saw exposed instances counted in the tens of thousands almost immediately after disclosure, and N-able’s fourth N-central hotfix this year followed a similar compressed timeline between patch and active targeting. The lesson security teams keep drawing from these incidents is that “patch Tuesday” thinking, where updates get applied on a weekly or monthly cadence, does not hold up against unauthenticated, Core-level, high-CVSS bugs in software this widely deployed.
What attackers can do with this vulnerability
The core mechanism, per the WordPress.org advisory, is that an unauthenticated attacker can manipulate page-template resolution into including a chosen, readable local PHP file located outside the active theme’s directories, a description NVD’s own October 2026 update to its listing independently corroborates. On a default, hardened configuration, that alone is a serious information-disclosure and site-manipulation risk. But WordPress.org’s own description notes that under certain server and theme conditions, this local file inclusion can escalate to full remote code execution, meaning an attacker could run arbitrary commands on the underlying server.
Neither WordPress.org, Patchstack, nor The Hacker News has published specific indicators of compromise, attacker IP ranges, or command-and-control infrastructure tied to this campaign as of this writing, and Help Net Security’s coverage of the 7.1.2 release similarly stops short of naming an attacker group. What is confirmed is the timing and the mechanism, not yet the identity or scale of whoever is running the scans Patchstack detected. Site owners should not wait for that attribution to act. The absence of named IOCs does not mean the absence of risk; it means the forensic picture is still being assembled.
How this compares to other WordPress-ecosystem incidents in 2026
WordPress and its surrounding plugin ecosystem have had a rough year on the security front. In August, Chinese state-linked hackers used compromised WordPress sites alongside a Zyxel device flaw to exfiltrate more than 18,500 government records, showing that WordPress compromises are frequently a stepping stone into larger intrusions rather than the end goal themselves. That case relied on plugin-level and device-level weaknesses; CVE-2026-87902 is notable because it lives in Core, meaning it does not depend on which plugins a site runs.
This also lands in a year where CMS-adjacent platforms have taken a broader beating. Joomla’s JCE editor suffered a zero-day rated CVSS 10.0 that put an estimated 2.5 million sites at risk earlier this year, and Adobe’s ColdFusion platform has been hit by more than one zero-day exploited within hours of disclosure, including one exploited within roughly two hours of becoming public. The common thread across all of these: content management and web-application platforms with large install bases are treated by attackers as high-value, low-effort targets, because a single working exploit can be pointed at millions of potential victims with minimal customization.
WordPress’s own patch history compounds the exposure. As tech-insider.org has previously reported, WordPress’s cumulative CVE count dwarfs that of newer, more locked-down website platforms, a tradeoff that comes bundled with the openness and plugin flexibility that made WordPress dominant in the first place. That tradeoff is precisely what security teams weigh every time a Core-level bug like this one surfaces.
The historical pattern: WordPress Core bugs move fast once public
WordPress has shipped Core security releases on a fairly regular cadence for years, and the pattern of rapid post-disclosure exploitation is not new to 2026, it has simply gotten faster and more automated. Earlier this year, a SharePoint RCE flaw and a Ruby on Rails ActiveStorage bug both showed similar dynamics: publicly disclosed, unauthenticated, high-severity vulnerabilities in widely deployed web frameworks attract automated scanning within a day or two, sometimes hours, of the fix becoming public.
What is arguably new is the scale of automation attackers now bring to bear. Mass internet scanning tools can fingerprint a WordPress version from its public-facing HTTP headers, generator meta tags, or readme files in seconds, then queue up exploitation attempts against every matching host they find, all without a human ever manually targeting an individual site. That is consistent with Patchstack recording a live exploitation attempt on the same calendar day WordPress shipped the fix. Nobody had to specifically target any one WordPress site; the scanning infrastructure simply found every exposed one it could.
Market and industry impact
WordPress’s scale means a Core-level, unauthenticated, critical-severity bug like CVE-2026-87902 has ripple effects well beyond individual site owners. Web hosting providers that manage large fleets of WordPress installs, managed WordPress specialists, and security vendors that sell WordPress-specific firewalls and scanners (Patchstack among them) all see a spike in activity around events like this: patch verification requests, firewall rule updates, and incident response engagements. For businesses that depend on WordPress hosting that can respond quickly to Core security releases, this is exactly the kind of event that separates hosts running proactive, forced-update policies from those leaving version management entirely in the customer’s hands.
The broader ransomware and extortion economy has also shown a pattern of using CMS-level footholds as an entry point into larger networks rather than the final target. Tech-insider.org’s earlier reporting on the ransomware economy found that initial access brokers routinely buy and sell compromised web application footholds, including WordPress installs, as a commodity, then resell that access to ransomware affiliates. A remote-code-execution bug in WordPress Core, reachable without authentication, is precisely the kind of vulnerability that access brokers prize, because it scales across an enormous number of potential targets with a single exploit chain.
What site owners and administrators should do now
Based on the guidance published by WordPress.org and Patchstack, the immediate priorities are straightforward:
- Confirm the site is running WordPress 7.1.2, or the correct backported patch version for its branch, and update immediately if not.
- Verify that automatic background updates are enabled for minor and security releases, WordPress’s default behavior unless it has been explicitly disabled.
- Review web server and firewall logs for suspicious requests beginning around September 22, 2026, 11:49 UTC, the timestamp Patchstack associated with the first observed exploitation attempt.
- Check for unauthorized PHP files, unexpected file modifications inside or outside the active theme directory, and any new or unfamiliar administrator accounts.
- Where feasible, restrict the web server process’s ability to read files outside the WordPress install directory, a defense-in-depth control that limits the blast radius of LFI-style bugs generally.
- If compromise is suspected, isolate the site, preserve logs for forensic review, rotate all credentials and API secrets, remove any unauthorized persistence mechanisms, and restore from a known-clean backup.
None of this is exotic advice, and that is the point. The mitigation for CVE-2026-87902 is the same mitigation that has applied to essentially every major WordPress Core bug for a decade: update fast, and assume that “fast” now means hours, not the days or weeks many organizations still budget for patch cycles. Sites sitting behind a web application firewall gained another layer of protection on October 1, 2026, when Cloudflare shipped a dedicated WAF rule targeting CVE-2026-87902 exploitation traffic, though that rule is a mitigating control, not a substitute for patching. Teams running vulnerability scanning programs can also fold this CVE into existing WordPress-focused tooling; WPScan-based scanning setups, for example, are commonly used to verify patch status across a fleet of WordPress installs at once, which is far more practical than manually checking each site.
What’s still unknown
Several important details remain unreported as of September 24, 2026. Neither WordPress.org, Patchstack, nor The Hacker News has published a confirmed count of how many sites have been successfully compromised, as opposed to merely probed. No specific attacker group, campaign name, or piece of malware has been publicly tied to the activity. CISA had not added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog as of the most recent reporting reviewed for this article, though that status can change quickly once active exploitation is independently confirmed by the agency. Readers should treat any claims about attacker identity, victim counts, or specific malware families beyond what is cited here as unverified until named outlets confirm them.
Predictions: where this goes from here
Based on how comparable Core-level, high-CVSS, unauthenticated bugs in widely deployed platforms have played out earlier in 2026, a few outcomes look likely in the days and weeks ahead:
- CISA is likely to add CVE-2026-87902 to its Known Exploited Vulnerabilities catalog once active exploitation is independently confirmed, following the same pattern seen with other Core-level CMS and framework bugs this year, including the VMware vCenter and Citrix NetScaler flaws covered previously on this site.
- Security vendors that sell WordPress-specific firewalls and scanners will likely publish detection signatures and blog writeups in the coming days, giving defenders a clearer picture of the exploitation traffic pattern than is currently public.
- Expect follow-up reporting to eventually attach a specific compromised-site count or campaign name to this activity, mirroring how earlier 2026 CMS bugs (Joomla’s JCE zero-day, for instance) went from “actively probed” headlines to concrete victim-count disclosures within one to two weeks.
- Given WordPress’s install base, some fraction of unpatched sites will likely be compromised and used for secondary purposes, such as spam distribution, credential phishing pages, or as a foothold for lateral movement, consistent with how prior WordPress and Zyxel-linked campaigns have unfolded this year.
- Expect renewed industry debate about whether WordPress’s plugin-and-theme-driven flexibility is worth the recurring Core-level exposure, a tradeoff this site has covered in the context of WordPress’s CVE history relative to newer, more locked-down platforms.
These are informed projections based on precedent, not confirmed facts, and should be read as such.
Frequently asked questions
What is CVE-2026-87902?
It is a critical, unauthenticated vulnerability in WordPress Core’s page-template resolution logic, rated CVSS 4.0 score of 9.2 by WordPress.org and independently scored 9.2 Critical by NVD in September 2026. It allows an attacker without any account access to force WordPress to include a chosen local PHP file, which can escalate to remote code execution under certain server and theme conditions.
Which WordPress versions are affected?
Every release from 4.7.0 through 7.1.1 is affected unless the relevant security backport has already been applied, according to WordPress.org. The fix shipped in version 7.1.2, with backports issued to 13 older branches down to 4.7.37.
How quickly are attackers exploiting this bug?
Patchstack recorded the first exploitation attempt at 11:49 UTC on September 22, 2026, the same day WordPress released the patch, according to Patchstack’s own reporting. The Hacker News confirmed active exploitation in its September 24 report.
Do I need to do anything if my host manages WordPress updates automatically?
If your host or your site applies WordPress’s default automatic background updates for security releases, you may already be running 7.1.2 or the correct backported version. It is still worth manually confirming the installed version, since some hosts and site configurations disable automatic updates for compatibility reasons.
Is this a plugin vulnerability or a WordPress Core vulnerability?
It is a WordPress Core vulnerability, not a plugin or theme issue. That means every WordPress site is potentially affected regardless of which plugins are installed, unless the Core software itself has been updated to a patched version.
Has CISA added this vulnerability to its Known Exploited Vulnerabilities catalog?
As of the most recent reporting reviewed for this article, CVE-2026-87902 had not yet appeared in CISA’s KEV catalog, though that status can change as active exploitation gets independently confirmed.
What should I check if I think my site was compromised?
Look for unauthorized PHP files, unexpected changes inside or outside your active theme directory, and unfamiliar administrator accounts. Review server logs for suspicious activity beginning around September 22, 2026, 11:49 UTC. If you find evidence of compromise, isolate the site, preserve logs, rotate credentials, and restore from a known-clean backup.
