Develop Better SolutionsBlog

Severity: CriticalDisclosed WordPress

WordPress core file inclusion flaw exploited: make sure you run 7.1.2 or a patched branch

A WordPress core flaw lets anyone without an account load files from the server, and on some setups run code.

Affects:WordPress 4.7 to 7.1.1Fixed: 7.1.2, 7.0.6, 6.9.9, 6.8.10

On September 22, 2026, WordPress released version 7.1.2, plus security updates for every older branch back to 4.7, to fix a critical flaw in WordPress core (CVE-2026-87902). An attacker without an account can make WordPress load a PHP file from elsewhere on the server. On some themes and server setups, this leads to running code and taking over the site.

Patchstack recorded the first attack attempts at 11:49 UTC on the day of the patch, and attempts to write files to the server by mid-afternoon. On September 25, 2026, CISA added the flaw to its list of vulnerabilities known to be exploited, as reported by the Canadian Centre for Cyber Security.

Sites that accept automatic background updates began updating on their own. If your site has updated since then, you are most likely already protected, but check the version.

Who is affected

  • WordPress versions 4.7 up to and including 7.1.1.
  • Full takeover needs extra conditions: the active theme must contain a folder whose name starts with "page-" (Wordfence cites themes such as Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney), and the server must hold a suitable PHP file. Do not rely on these conditions to skip the update.

How to check your site

  1. Log in to WordPress and open Dashboard > Updates to see your version.
  2. The fixed versions are 7.1.2 for the current branch, and 7.0.6, 6.9.9 and 6.8.10 for recent older branches. Older branches received their own patched release.
  3. Look in Users for administrators you do not recognise, and in Plugins for anything you did not install.

If you cannot log in, ask your host or developer for the WordPress version.

What to do now

  1. If you are below the fixed version for your branch, click Update Now, or ask your host or developer to update today.
  2. If you run a very old branch, plan a move to the current version of WordPress: only the most recent version is actively supported.
  3. If anything looks unfamiliar after the update, ask your host or a security professional to check the site and change your passwords.

This alert reports what the sources listed below published and is not a guarantee about any specific site.

Sources