On September 24, 2026, the digital infrastructure underlying nearly half the world's websites was shaken when a critical flaw in WordPress—one allowing strangers to walk through locked doors and rewrite what they find—was patched and exploited within the same breath. CVE-2026-87902 required no password, no invitation, only a crafted request and an unguarded server. The gap between remedy and assault has narrowed to hours, reminding us that in the architecture of the modern web, the moment of disclosure is also the moment of danger.
WordPress Critical Vulnerability Exploited Within Hours of Patch Release
The window between patch and attack has collapsed to hours
Mark
So this vulnerability—CVE-2026-87902—what exactly could an attacker do with it?
Mimi
They could bypass authentication entirely and traverse the file system to access files they shouldn't see, then execute code on the server. That's essentially full control.
Luke
Full control is the end state, but let's be precise: the vulnerability itself is path traversal plus code execution capability. Both had to be present for the worst outcome.
Mark
And it was being exploited within hours of the patch?
Mimi
Yes. The moment WordPress released 7.1.2, attackers already had the information they needed to target older versions. Scanning and exploitation began immediately.
Luke
We should note that "immediately" here means the same day, based on the reporting. I don't see a specific timeline for how many attacks occurred or how many sites were compromised.
Mark
Why does WordPress get hit so hard, so fast?
Mimi
It powers roughly 43 percent of all websites. That's an enormous target surface. Any vulnerability in WordPress affects millions of potential victims.
Luke
That's a commonly cited figure, but it's worth noting it's based on web crawl data from sites that declare their platform. The actual number of WordPress installations is harder to pin down.
Mark
So what's the real risk for someone running an older version right now?
Mimi
If you haven't updated to 7.1.2, your site is actively being scanned and probed. Attackers have working exploit code. Compromise is not theoretical—it's happening.
Luke
That's true for the hours and days immediately after disclosure. The risk remains high as long as the vulnerability is unpatched, but the intensity of active scanning does tend to peak early and then shift as attackers move on to other targets.
Mark
What should someone do?
Mimi
Update to 7.1.2 immediately. Don't wait for a maintenance window. This is the exception to normal testing protocols.
Luke
That's the right call. The only caveat is that some administrators might face genuine compatibility issues with plugins or themes, but even then, the security risk outweighs the operational risk in this case.
The Pulse
- A zero-authentication path traversal flaw gave attackers the ability to roam server file systems and execute arbitrary code—effectively handing over the keys to any unpatched WordPress site.
- Exploitation began within hours of the patch release, collapsing the traditional grace period administrators once relied upon to test and deploy updates safely.
- With WordPress powering roughly 43 percent of all websites, the pool of vulnerable targets numbered in the millions the moment the vulnerability became public knowledge.
- Automated scanning tools and rapidly deployed exploit code mean that unpatched servers are being actively hunted right now, not in days or weeks.
- WordPress 7.1.2 closes the vulnerability, and administrators are urged to update immediately—compatibility concerns and testing cycles are no longer justifications for delay when live attacks are already underway.
On September 24, 2026, the digital infrastructure underlying nearly half the world's websites was shaken when a critical flaw in WordPress—one allowing strangers to walk through locked doors and rewrite what they find—was patched and exploited within the same breath. CVE-2026-87902 required no password, no invitation, only a crafted request and an unguarded server. The gap between remedy and assault has narrowed to hours, reminding us that in the architecture of the modern web, the moment of disclosure is also the moment of danger.
On September 24, 2026, WordPress shipped version 7.1.2 to close a critical security flaw that had already begun drawing fire. The vulnerability, CVE-2026-87902, required no credentials whatsoever—an attacker needed only to send a malicious request to traverse the server's file system and execute arbitrary code, gaining the kind of control that lets an intruder read databases, plant backdoors, steal data, or pivot toward other targets entirely.
The timing was unforgiving. Security researchers disclosed the flaw, the patch shipped, and within hours attackers were weaponizing it. This is the compressed rhythm of modern exploitation: a patch is a map, and those who want to break things use it to find every server that hasn't followed the directions yet. For a platform running nearly half the internet, that population of laggards is enormous.
Path traversal attacks are not exotic. They work by manipulating file path sequences to escape intended directories and reach files the application was never meant to expose. What made this instance severe was the absence of any authentication requirement—no account, no session, no foothold needed. The server was simply open to anyone who knew how to ask.
The broader lesson is one administrators have been slow to absorb: the window between patch release and active exploitation has effectively vanished. Automated scanners identify vulnerable versions instantly; exploit code scales within the same day. The old calculus of waiting for a maintenance window no longer applies to critical flaws. The fix exists, the attacks are live, and the cost of delay—compromise, data loss, reputational harm—dwarfs the friction of a fast update.
On September 24, 2026, WordPress released version 7.1.2 to address a critical security flaw that had already begun circulating in active attacks. The vulnerability, tracked as CVE-2026-87902, allowed unauthenticated attackers to traverse the file system on vulnerable servers and execute arbitrary code—a combination of weaknesses that could give an intruder complete control over a website without needing a password or login credentials.
The timing was brutal. Security researchers disclosed the flaw publicly, WordPress shipped the patch, and within hours, attackers were already weaponizing it. This is the standard rhythm of modern vulnerability exploitation: the moment a patch exists, the people who want to break things know exactly what to fix, and they begin probing for servers that haven't updated yet. For a platform that powers roughly 43 percent of all websites on the internet, those unpatched servers number in the millions.
Path traversal vulnerabilities are a well-understood attack vector. They work by manipulating file paths—using sequences like "../" to navigate outside the intended directory and access files the application never meant to expose. In this case, the flaw allowed someone to do this without authentication, meaning they didn't need to be a registered user or have any legitimate access to the site. They could simply craft a malicious request and send it to any WordPress installation running an older version.
Once inside the file system, the attacker could execute code. This is where the severity becomes absolute. Code execution means the attacker can do anything the web server itself can do: read databases, modify content, install backdoors, send spam, steal customer data, or use the compromised server as a launching point for attacks on other targets. A single unpatched WordPress site becomes a foothold into a network.
The fact that exploitation began immediately after disclosure underscores a hard reality for website administrators: the window between "patch released" and "active attacks in the wild" has collapsed to hours, sometimes minutes. Automated scanning tools can identify vulnerable versions instantly. Exploit code can be written and deployed at scale within the same day. The old assumption that you have time to test a patch before applying it no longer holds for critical flaws.
WordPress 7.1.2 closed this particular door, but the broader vulnerability landscape remains dense. Every widely-used platform faces this pressure: the more sites it powers, the more attractive it becomes as a target. Attackers know that a significant percentage of website owners will delay updates—due to compatibility concerns, testing overhead, or simple inattention. Those delays create a window of exposure that active threat actors will exploit.
For administrators managing WordPress installations, the message is unambiguous: update immediately. Waiting for a convenient maintenance window or testing cycle is no longer a viable strategy when exploitation is already underway. The cost of delay—potential compromise, data loss, reputation damage—far exceeds the risk of applying a security patch quickly. The vulnerability is real, the attacks are happening now, and the fix is available.
Notable Quotes
The moment WordPress released 7.1.2, attackers already had the information they needed to target older versions— Security analysis of exploitation timeline
Want the full story?
Read the original at Google News ↗