{"id":9581,"date":"2026-09-24T20:26:22","date_gmt":"2026-09-24T20:26:22","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9581"},"modified":"2026-09-24T20:26:22","modified_gmt":"2026-09-24T20:26:22","slug":"wordpress-patches-a-critical-severity-security-vulnerability","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9581","title":{"rendered":"WordPress patches a critical severity security vulnerability"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

WordPress has patched what it described as a critical severity security vulnerability that would allow an unauthenticated attacker full remote code execution (RCE) capabilities. There have already been reports of attacks in the wild.<\/p>\n

Given its popularity, WordPress has frequently been under attack<\/a>, and patched another maximum severity bug allowing RCE<\/a> in July. WordPress said the current hole, tracked as CVE-2026-87902<\/a>, was discovered and reported to the company by Switzerland-based security researcher Robert Ressl<\/a>.<\/p>\n

The post<\/a> announcing the WordPress 7.1.2 security release said that the fix addressed an issue where \u201can unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).\u201d<\/p>\n

It urged users to update their sites immediately, and said that the fix had been backported through version 4.7, as the hole also impacts many older versions of WordPress.<\/p>\n

Noah Kenney<\/a>, principal consultant at Digital 520, said his top concern was the massive extent of damage an attacker could inflict with this hole.\u00a0<\/p>\n

\u201cOnce attackers have PHP execution, they can read wp-config.php<\/em>, obtain database credentials and authentication keys, create administrator accounts, alter payment or lead capture forms, redirect visitors, and install persistent code,\u201d he said. \u201cThe less obvious part is how they get there. Pearcmd.php<\/em> is a legitimate PHP package management tool, but attackers can abuse its configuration commands to write content of their choosing to disk. The current attacks use it to place malicious PHP in \/tmp<\/em>, then use the WordPress flaw to load and execute that file. A security team monitoring only the WordPress directory for changes could miss that first stage entirely.\u201d<\/p>\n

New risk reality<\/h2>\n

But IDC and others saw the speed with which attacks began as the most concerning element of this report.\u00a0<\/p>\n

\u201cThis WordPress vulnerability is a textbook example of the new risk reality: attackers are exploiting critical bugs within hours of disclosure, and most enterprises are not patching fast enough to keep up,\u201d said IDC Research Director Philip Harris<\/a>, citing reports from security firm Patchstack<\/a> that attackers had leveraged the hole shortly after WordPress posted the patch.\u00a0<\/p>\n

Patchstack said, \u201cWhen this post first went up, every request we had seen was reconnaissance against harmless core files. That is no longer true. Attackers are now including pearcmd.php<\/em> and using it to write PHP files to disk and public scanning tooling for this CVE is in circulation.\u201d<\/p>\n

IDC\u2019s Harris noted that Patchstack\u2019s telemetry illustrated the new reality, with attacker reconnaissance occurring within five hours of the patch, and full exploitation within about a day. \u201cThe window between disclosure and exploitation has collapsed to the point that mean time to exploit for critical vulnerabilities is now negative in some cases, meaning exploit code appears before or immediately after a patch ships,\u201d he said. \u201cThis WordPress bug tracks that pattern closely: Patchstack recorded the first probing traffic under five hours after WordPress 7.1.2 was released, and traffic volume increased roughly tenfold within a day as attackers moved from scanning to actual payload delivery.\u201d<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, agreed.<\/p>\n

\u201cThe number that should anchor this story is not the 9.2 CVSS score, but it is the gap between patch and exploit. With this vulnerability, that gap was effectively zero,\u201d he said. \u201cWordPress shipped 7.1.2 on September 22, and Patchstack blocked the first exploitation attempt at 11:49 UTC the same day, using payloads that matched the exact encoding the patch was written to fix. Attackers did not discover this bug. They read the fix. Publishing a patch is now functionally publishing an exploit guide, and any enterprise still running a remediation cycle measured in weeks is operating on a timeline that stopped existing some time ago.\u201d<\/p>\n

Speedier patching needed<\/h2>\n

One response to the speed of attacker actions is to automate updates, but that is not necessarily a good option. Some enterprise CISOs are nervous about excessive patch automation; they want to review and approve any system changes, mostly to avoid disasters such as 2024\u2019s Crowdstrike incident<\/a>.\u00a0<\/p>\n

Ressl said in an interview that another concern about automated updates is that many enterprises don\u2019t perform sufficient verification that the updates executed properly.<\/p>\n

\u201cHaving automatic updates enabled is not the same as verifying that the patch is installed,\u201d he said. \u201cCompatibility and availability concerns are legitimate reasons for testing updates. My recommendation is a rapid, tested rollout with verification across all exposed installations, including staging sites.\u201d<\/p>\n

Mahapatra added that the problem with update automation is especially severe in larger enterprises.\u00a0<\/p>\n

\u201cWordPress applies minor security releases automatically by default, which means the average hobbyist blog is probably already patched,\u201d he pointed out. \u201cEnterprise sites routinely disable those auto-updates to enforce change control, so the organizations with the most mature governance are the ones most likely to still be exposed this week, because their own process is holding the fix in a queue while attackers scan. Change control that cannot distinguish an unauthenticated remote code execution flaw from a routine plugin update is protecting the process rather than the enterprise, and this is the vulnerability that makes that distinction expensive.\u201d<\/p>\n

And, noted Nidhi Luthra<\/a>, executive advisor for Acceligence: \u201cA security release can become an attacker roadmap almost immediately, so emergency patching for internet-facing systems needs an hours-level response.\u201d<\/p>\n

Forgotten WordPress sites may not be patched<\/h2>\n

Mahapatra added that another, perhaps bigger, concern is the fact that many enterprise WordPress deployments happen below the radar. They are not typical shadow IT, because they are fully authorized at the time, but they are still often unknown to IT management.\u00a0<\/p>\n

In enterprises, he said, \u201cthe exposure is materially larger than most organizations will assume because most enterprises do not think of themselves as WordPress shops, and almost all of them are. The risk sits in the web estate that IT never inventoried: marketing microsites, campaign landing pages, regional country sites, investor relations pages built by an outside agency, and the properties of companies acquired three years ago that nobody got around to migrating. The affected [WordPress version] range runs from 4.7.0 through 7.1.1, nearly a decade of installs, and the forgotten sites are precisely the ones still sitting on old branches.\u201d<\/p>\n

Mahapatra said that he has especially seen this in enterprises in the finance vertical.<\/p>\n

\u201cWhen I walk through external attack surface reviews with banking CISOs, the WordPress instances that surface are almost never the corporate site,\u201d he said. \u201cThey are the sites that belong to marketing, a subsidiary, or an agency contract that expired, and none of them appear in the CMDB the security team is patching against.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

WordPress has patched what it described as a critical severity security vulnerability that would allow an unauthenticated attacker full remote code execution (RCE) capabilities. There have already been reports of attacks in the wild. Given its popularity, WordPress has frequently been under attack, and patched another maximum severity bug allowing RCE in July. WordPress said […]<\/p>\n","protected":false},"author":0,"featured_media":9582,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9581"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9581"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9581\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9582"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}