Critical WordPress Flaw Is Being Exploited Right Now: A Security Update Checklist for 2026

If your business website runs on WordPress, this is one alert worth stopping for. A critical vulnerability in WordPress core is being actively exploited right now — no login required — and on September 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, the list reserved for flaws attackers are using in the wild, not just theorizing about.

The good news: the fix exists, it’s free, and most of the work is a single update. The bad news: hundreds of thousands of sites haven’t applied it, and scanners are finding them every day.

This post explains what happened in plain English — no security degree required — and gives you a how to secure WordPress site beginners checklist with seven practical steps. Whether you manage the site yourself or pay a host to do it, every step is something you can do today.

What CVE-2026-87902 Is, in Plain English

The flaw lives in WordPress core’s page-template resolution — specifically the get_page_template() function in wp-includes/template.php, the code that picks which theme file renders a page. Because of a path-traversal weakness (classified as CWE-98), an attacker who doesn’t even need an account can trick that function into loading a readable local .php file from outside the active theme’s directories.

In most configurations that’s a file-inclusion problem — an attacker could read sensitive server files like wp-config.php (which holds your database credentials). But when specific server and theme conditions line up, it escalates to remote code execution (RCE): the attacker runs their own code on your server. That can mean planted web shells, defaced pages, stolen customer data, or your site quietly turned into a launchpad for attacks on others.

The key facts, all from the published advisories:

• CVE ID: CVE-2026-87902 (also GHSA-7hp8-65ch-5whp). Severity: critical — CVSS 9.2 (v4) / 8.1 (v3).
• Affected: every WordPress release from 4.7.0 through 7.1.1 — nearly a decade of versions.
• Fixed in: WordPress 7.1.2, released September 22, 2026, with the fix backported to every security-supported branch going back to 4.7.37. You don’t have to jump to the latest major version to be safe — just the latest release in your branch.
• Reported by: security researcher Robert Ressl, with CISA adding the flaw to its KEV catalog on September 25, 2026.

One note for accuracy: CISA’s entry calls this “remote file inclusion,” but that label can mislead. What WordPress actually documented is the inclusion of a file that already exists on your server (local file inclusion) — not code fetched from the attacker’s machine. Threat trackers describe it most precisely as unauthenticated local file inclusion with conditional RCE.

Why This One Deserves Your Attention

Small-business owners often assume hackers only chase big brands. This flaw is different, for four reasons:

1. No login needed. The attack reaches WordPress core before any authentication, plugin logic, or most firewall rules. Anyone on the internet can probe for it.

2. The vulnerable population is enormous. WordPress powers more than 43% of the public web. Within days of the September 22 patch, threat-tracking firm Shadowserver identified more than 350,000 exposed WordPress instances still running vulnerable versions — a scanning target list handed to attackers essentially for free.

3. Exploitation started immediately. Security sensor network Previdian observed 3,238 exploitation attempts from 21 unique attacker IPs across 13 countries between September 23 and October 6, 2026. Attackers began probing the day the fix shipped.

4. The full attack chain is well understood. The escalation to code execution needs three things to line up: an active theme with a top-level directory starting with page-, PEAR’s pearcmd.php reachable on the server, and PHP’s register_argc_argv setting switched on. Hosts built on official PHP Docker images or cPanel setups with older PHP were specifically flagged as exposed.

How to Secure WordPress Site Beginners Checklist: 7 Steps for This Week

Step 1: Check your WordPress version

In your dashboard, look at the bottom-right corner or go to Dashboard → Updates. If you’re running 7.1.2, 7.0.6, 6.9.9, 6.8.10, or the fixed security release for your older branch, you’re patched against this flaw. Anything else — patch now.

Important trap: if you updated to 7.1.1 earlier this month, you are still vulnerable. Version 7.1.1 sits inside the affected range; you need 7.1.2. Don’t assume your site is fine just because you “just updated.”

Check every site you manage — and don’t forget staging copies, development sites, and old container images. Attackers probe everything reachable.

Step 2: Update to the fixed release

The minimum you need for your branch:

Your branch	Update to at least
7.1.x	7.1.2
7.0.x	7.0.6
6.9.x	6.9.9
6.8.x	6.8.10
Older branches	The latest security release of that branch (fixes go back to 4.7.37)

Run the update from Dashboard → Updates, then confirm the version number actually changed — do not assume an automatic background update succeeded on every site. If your host manages WordPress updates for you, open a ticket or check their status page to confirm the update completed. While backports close this one hole, running an old branch is still a long-term risk, so plan an upgrade to a current release when you can.

Step 3: Check whether you were already hit

Because exploitation began the day the patch shipped, updating isn’t enough if attackers got there first. Spend 15 minutes looking for compromise indicators:

• Access logs: look for requests where pagename and page_id appear together on the site root or /index.php — the two rarely appear together in normal traffic — especially with encoded traversal sequences like %2e%2e or %252e%252e in the query string or POST body.
• Temporary directories: inspect /tmp, /var/tmp, and your uploads folder for unexpected new PHP files. Reports flag names like wp-pear-rce-flag.php, poc87902.php, and files with luci_ or zeta_ prefixes. A freshly created webshell often has a name designed to blend in with WordPress core filenames.
• User accounts: review Users → All Users for unfamiliar administrator accounts — or a secret second account alongside your own.

If you find any of these, treat the site as potentially compromised and jump to the incident section below before doing anything else.

Step 4: Harden PHP (kills the RCE chain even on unpatched sites)

The demonstrated attack chain needs PHP’s register_argc_argv switched on for web requests, combined with a reachable pearcmd.php from PEAR. Two changes break it:

1. In your php.ini or your host’s PHP configuration panel (cPanel’s MultiPHP INI Editor, for example), set register_argc_argv = Off. A web-facing WordPress process has no legitimate use for it.
2. Check whether PEAR’s pearcmd.php exists on your server. On most shared hosting it’s a legacy artifact nobody uses — removing it or restricting read access closes the primary RCE vector.

These are server-level settings, so you may need your hosting provider’s help — a five-minute support ticket.

Step 5: Add a firewall layer (but don’t treat it as the fix)

Security vendors shipped virtual patches within hours of disclosure. Wordfence, for example, gave Premium, Care, and Response customers a firewall rule on September 22, 2026; Wordfence Free users receive the same rule on October 22, 2026.

If an immediate core update is genuinely impossible — a custom fork, a frozen deployment window — activate a security plugin’s firewall (Wordfence, Patchstack, or your host’s WAF) and schedule the core update the moment you can. A firewall is an important layer of protection, but it is not a substitute for patching.

Step 6: Turn on automatic updates and fix your backups

Two policies that would have made this a non-event:

• Enable automatic core updates. In WordPress, go to Dashboard → Updates and confirm auto-updates are on. Security releases are minor, automatic, and exist for exactly this scenario. (For a broader take on keeping your site stack current, our guide to the best software for small business in 2026 covers backup tools worth pairing with this.)
• Keep tested backups. An automatic daily backup is only useful if you know it restores. Download a backup, restore it somewhere safe (your host’s staging tool works), and confirm it opens. A clean backup is your escape hatch if you ever do get compromised.

Step 7: Make security a habit, not a panic

This flaw got the headlines, but the weekly grind is what actually protects a business site: update plugins and themes promptly, delete plugins you don’t use, give accounts the minimum privileges they need, enforce two-factor authentication for every administrator, and use strong, unique passwords. If your blog is part of your marketing engine, our guide to starting a business blog that ranks on Google covers the maintenance routines that keep both security and SEO healthy.

What to Do If You Find Signs of Compromise

Don’t try to clean a hacked server by hand while it stays online. Take the site offline or put it in maintenance mode, then work from a known-clean backup taken before the exposure window (pre–September 22, 2026 for this flaw). Change every password — WordPress admins, hosting panel, database, and SFTP — audit all user accounts and scheduled tasks, review recently installed or modified plugins, and check server logs for the attacker’s entry point. If the site handles customer data or payments, treat it as a real incident: document what you find and consider professional incident-response help. Patching after a compromise without cleaning up leaves the attacker’s backdoor in place.

FAQ

Is my site affected if I use a page builder or a premium theme?
The underlying flaw is in WordPress core, not in any plugin or theme — every install from 4.7.0 through 7.1.1 carries it. The escalation to full remote code execution needs extra conditions (like a page- directory in the active theme), but the file-inclusion exposure exists regardless. Patch.

I have automatic updates enabled. Am I safe?
Probably, but verify. Check the actual version number in your dashboard rather than assuming the background update ran. If you’re on an older branch, your host or update service should have applied that branch’s backported security release — confirm it’s there.

Can a security plugin’s firewall protect me instead of updating?
Partially, and temporarily. Firewall rules like Wordfence’s detect and block the traversal pattern in the malicious requests, which buys time. But vendors themselves say the firewall is a layer, not a replacement for the core patch. Update first; firewall second.

Does this affect sites hosted on WordPress.com?
WordPress.com manages core updates for you, so those sites were patched automatically. This checklist is aimed at self-hosted WordPress sites, where the owner or their host is responsible for updates.

Bottom Line

CVE-2026-87902 is exactly the kind of flaw that punishes “I’ll update next week”: unauthenticated, in core, actively scanned within hours, and serious enough for CISA’s exploited-vulnerabilities list. But the fix is equally straightforward — update to 7.1.2 (or your branch’s fixed release), check for signs of prior compromise, and harden the PHP settings that complete the attack chain. Twenty minutes of maintenance today beats a weekend of incident response later. If you’re building or maintaining a business site on WordPress, make this week’s update the one you don’t skip. If this week’s fire drill has you questioning the plugin treadmill altogether, our EmDash vs WordPress 2026 comparison looks at how EmDash’s sandbox model contains exactly this class of flaw.