Patch Now: Critical WordPress Vulnerability CVE-2026-87902 is Being Exploited

A critical WordPress flaw is being actively exploited. SMBs need to act fast to stay secure.

The short version

CVE-2026-87902 is a remote file inclusion flaw in WordPress Core.
SMBs using WordPress should update immediately.
Check if your site is still vulnerable by confirming the version is updated.
If you don’t know how to patch, contact a trusted IT provider.

What is CVE-2026-87902 and why is it dangerous?

CVE-2026-87902 is a vulnerability in the core of WordPress, the most widely used content management system (CMS) in the world. It allows attackers to include and execute remote files on your website. In simple terms, this means someone could trick your website into loading and running code from a malicious source. Once that code is running, the attacker can take full control of your site or steal sensitive data.

This vulnerability is particularly dangerous because it is being actively exploited in the wild. That means cybercriminals are already using it to target websites. If your WordPress site is still using an unpatched version, you are at risk. This is not a hypothetical threat—it’s happening now.

How does this affect SMBs?

Many SMBs use WordPress to run their websites, from small e-commerce stores to local service providers. If your site is built on WordPress and you haven’t updated to the latest version, you are at risk. Attackers can use this flaw to take over your site or steal sensitive data like customer information or login credentials.

If you're not sure whether your site is built on WordPress, it's worth checking. If your site is a blog, a portfolio, or a store, it's likely built on WordPress. If you're using a hosted service, they may be handling WordPress updates for you. In any case, if you run a WordPress site, you need to act now.

What should you do this week?

The first and most important step is to update your WordPress installation to the latest version. WordPress typically releases patches for vulnerabilities like this quickly, and the fix is usually a simple update. If you're using a managed WordPress host, they may have already applied the patch for you. But if you're managing your own site, you must update manually.

If you're not technical and don't know how to update, contact your web developer or IT provider immediately. Don’t wait—this is a high-priority issue. If you're unsure whether you're using a supported version, check the WordPress dashboard under 'Updates.' If a new version is available, update it now.

Also, ensure that all plugins and themes are updated. Sometimes, outdated plugins can reintroduce vulnerabilities even if WordPress is up to date. Make sure everything is current.

How can you tell if you were already hit?

If your site was compromised before the patch was applied, it may already be infected. Signs of a breach include unexpected changes to your site's content, strange redirects, new admin users, or a sudden drop in site performance. You may also notice that your site is serving malware or has been blacklisted by search engines.

If you suspect your site has been hacked, take it offline immediately and contact a cybersecurity professional. Do not try to fix it yourself unless you're experienced. A professional can scan your site, remove malicious code, and restore it to a secure state.

Not sure whether your environment is exposed? That is exactly what our Web Application Penetration Testing service is built to surface. Talk to us.

Frequently asked questions

Can this affect my WordPress site if I don't use plugins?

Yes, this vulnerability is in WordPress Core, so it affects all WordPress sites, regardless of plugins. Even if you don't use any plugins, you're still at risk if your WordPress version is outdated.

What if I don't run my own WordPress site?

If you use a hosted service or a managed WordPress provider, they may be handling updates for you. However, it's still a good idea to confirm with them that the patch has been applied.

How long do I have to fix this?

The U.S. government has set a remediation deadline of September 28, 2026, for federal agencies. While SMBs aren't under the same mandate, the window is short, and attackers are already exploiting this. You should patch as soon as possible.

Is there a way to check if my site has been patched?

Yes. Check the version number in your WordPress dashboard under 'Updates.' If it's the latest version, you're likely patched.

Source (public domain): CISA