Security guide
WordPress CVE-2026-87902: What to Do
CVE-2026-87902 is a critical flaw in WordPress core, not in PHP itself: an unauthenticated request can make WordPress include a PHP file it should not, which can become remote code execution on some servers. It affects WordPress 4.7.0 through 7.1.1 and was fixed on September 22, 2026. Update to 7.1.2, or the fixed release for your branch (7.0.6, 6.9.9, 6.8.10, or the 4.7.37 backport), before considering anything else.
By Web Your Vyavsay team · Published
Drafted with AI assistance. Claims are checked against the sources listed below and reviewed by our team.
Confirm the version table against the official WordPress advisory (GHSA-7hp8-65ch-5whp) before acting.
How serious is it?
- Severity: Patchstack lists a CVSS score of 9.2 (critical); OpenCVE lists 8.1. The difference comes from the scoring version used. Both are high.
- No login is needed to send the request.
- Timing: the fix shipped on September 22, 2026, and the first exploitation attempt was recorded the same day, at 11:49 UTC, according to Patchstack.
- Public scanning tools were circulating by September 23, and CISA added the flaw to its list of known exploited vulnerabilities on September 25, 2026.
- Whether code execution works depends on server and theme setup, which is why some sites were exposed and others were not.
What to do today
- 1
Check your version
In the WordPress admin, open Dashboard, then Updates. Any version from 4.7.0 to 7.1.1 is affected.
- 2
Update to the fixed release for your branch
Use 7.1.2 if you can. Otherwise install your branch’s fixed release: 7.0.6, 6.9.9, 6.8.10, or 4.7.37 for the oldest branch. Take a backup first.
- 3
Confirm the version afterwards
Reload the Updates screen and check that the new version is shown.
- 4
Check whether you were probed or compromised
Use the indicators in the next section. Patching closes the hole but does not remove anything an attacker already left behind.
If you cannot update right away
Patchstack describes two stopgaps. They reduce risk while you arrange the update; they do not replace it.
- Block requests whose pagename parameter contains directory-traversal sequences. A real page name never does.
- Turn off the PHP setting register_argc_argv. It does not fix the file inclusion, but it breaks the known route to code execution through PEAR’s pearcmd.php.
Signs your site was probed or compromised
These indicators come from Patchstack’s write-up. Search your web server logs for:
- A pagename parameter containing encoded traversal sequences, or starting with a page- directory name.
- pagename and page_id used together on the site root or index.php.
- Requests containing pearcmd or +config- arguments.
- A normal page URL that returns RSS or OPML feed content, which Patchstack treats as proof the site was in the vulnerable window.
On the server, look for unexpected .php files in /tmp and /var/tmp. Patchstack says their presence means a file-write attempt succeeded and the host should be treated as compromised. Most attack traffic used spoofed user agents, so do not rely on user-agent filters.
After patching: when does moving off WordPress make sense?
WordPress is a sound choice for many sites, and this flaw is not a reason to leave it by itself. It is a reason to ask who is responsible for updates and how much code runs on your public site.
| Staying on WordPress fits when | Moving fits when | |
|---|---|---|
| Updates | Someone patches core, themes and plugins within days | Nobody owns updates, or sites sit unpatched for months |
| Plugins | A few well-maintained plugins | Many plugins stacked to cover login, forms, membership and payments |
| Login and access | Standard roles are enough | You need MFA, SSO, enterprise roles or custom permissions built into the product |
| Content editing | Non-technical staff edit pages daily | Content changes rarely, or a developer team manages it |
For the wider evidence, see WordPress vs a custom website: is moving safer?. If the right-hand column describes you, read WordPress to Next.js migration, including what a custom build gives up as well as what it adds.
Frequently asked questions
- Is CVE-2026-87902 a PHP vulnerability?
- No. The flaw is in WordPress core. PHP matters because, according to Patchstack, the code-execution path needed the PHP setting register_argc_argv to be enabled, so changing that setting breaks one known attack chain. It does not remove the flaw.
- Which WordPress versions are affected, and which are fixed?
- Affected: WordPress core 4.7.0 through 7.1.1. Fixed releases: 7.1.2, 7.0.6, 6.9.9, 6.8.10, with a backport to 4.7.37. Check your version under Dashboard, then Updates, and confirm it afterwards.
- Do plugins or themes matter for this one?
- The vulnerable code is in core, so updating core is the fix. Patchstack reports that the code-execution path needed an active theme with a top-level page- directory, which is why exposure varies from site to site. Do not rely on that: update regardless.
- My host says it already protects me. Do I still need to update?
- Yes. Some managed hosts added their own protections. Pantheon, for example, deployed platform-wide mitigations while still telling customers to update their sites as soon as possible.
- Do I have to leave WordPress because of this?
- No. A patched, well-maintained WordPress site is not unsafe because of this CVE. Moving makes sense for other reasons, covered below: heavy plugin dependence, custom login and access needs, or no one responsible for updates.
Sources
- Patchstack: attackers started probing WordPress sites hours after the patch
- Kaspersky: CVE-2026-87902, critical vulnerability in WordPress
- The Hacker News: attackers exploit WordPress CVE-2026-87902 within hours of disclosure
- OpenCVE: CVE-2026-87902 vulnerability details
- Pantheon: WordPress 7.1.2 release notes
These are news and vendor write-ups. Where they differ, such as on the severity score, both figures are shown above. Check the official advisory for the final version table.