Most critical WordPress holes live in plugins. This time is different: on September 22, 2026 the WordPress team shipped a security fix for the core itself. The flaw, tracked as CVE-2026-87902, scores 9.2 out of 10 and affects every release from 4.7.0 through 7.1.1. In other words, practically every WordPress site on the internet.
What actually happened
This is a local file inclusion bug in the way WordPress selects a page template. The template filename is built from parts of the URL, but path validation was insufficient. An attacker who has no account and does not need to be logged in can make the site load a PHP file from outside the theme directories.
Loading a foreign file does not automatically mean a full takeover. However, on servers with a specific PHP configuration and a theme that contains folders with a page prefix, the issue can escalate to remote code execution, the worst case: the attacker runs their own commands on your server.
Which versions are fixed
The team released patches for several branches at once, so you can get the fix even if you are not on the latest version:
- 7.1 branch: version 7.1.2
- 7.0 branch: version 7.0.6
- 6.9 branch: version 6.9.9
- 6.8 branch: version 6.8.10
- 6.7 branch: version 6.7.9
- 6.6 branch: version 6.6.9
- 4.7 branch: version 4.7.37
The flaw was found by security researcher Robert Ressl and privately reported through HackerOne in July. No active exploitation attempts had been reported when the fix shipped. That is good news, but not a reason to wait: once a patch is public, attackers diff it against the old code and working exploits often appear within days.
What to do right now
1. Check your version. In the dashboard, open Updates. If you see 7.1.1 or lower, update.
2. Verify automatic updates. Core security fixes normally install in the background. On many sites they are disabled, for example by hosting configuration or a constant in wp-config.php. Confirm the fix really landed.
3. Back up first. Minor security releases are low risk, but a backup is cheap insurance.
4. Consider extra hardening. Security firm Patchstack suggests disabling the PHP setting register_argc_argv and removing unused PEAR components. It does not replace the patch, it only makes exploitation harder on some servers. This is server-level work for your hosting administrator.
Why it matters even for small sites
WordPress attacks are automated today. Bots crawl the internet and try known vulnerabilities on thousands of sites a day, whether it is a company shop or a freelancer’s business card site. Size is irrelevant; only whether the patch is applied matters.
A core flaw is also nasty because careful plugin selection cannot protect you from it. You can run only vetted add-ons and still be vulnerable. That is why regular update management is a security basic, not an optional luxury.
Conclusion
A critical core flaw is a reminder that security is not a one-off task. If you are not sure which version your site runs or whether the update installed, get in touch. At Full-Net we take care of WordPress maintenance, updates and backups, so you do not have to rely on luck. Contact us and we will check your site today.
