Was my WordPress site affected by CVE-2026-87902?
Short answer: every WordPress release from 4.7.0 to 7.1.1 published before 22 September 2026 has this flaw. If your site shows a version older than the fixed release of its line (7.1.2, 7.0.6, 6.9.9, 6.8.10 and so on, see the table), it is potentially affected and should be updated. If your site hides its WordPress version, we cannot tell. Paste your address below for a free check.
This is an earlier wave. We added this page afterwards as background; it was not published when the flaw was disclosed. Last updated: 26 October 2026.
What happened
On 22 September 2026 WordPress released version 7.1.2 to fix CVE-2026-87902, a critical flaw in how WordPress core chooses page templates. Someone who is not logged in could make WordPress load a PHP file from outside the theme folders. On servers and themes that meet certain conditions, that lets them run their own code.
As a courtesy to sites on older versions, WordPress backported the fix to every line from 4.7 onwards. Attack traffic was reported from the first evening, and on 25 September 2026 the US cybersecurity agency CISA added the flaw to its catalogue of vulnerabilities known to be exploited.
The advisory names some themes that meet the theme condition, including the older default themes Twenty Twelve and Twenty Fourteen. We cannot see from the outside whether your theme and server meet the conditions, so we only compare versions. Update either way.
Which versions are fixed
| WordPress line | Fixed in |
|---|---|
| 7.1 | 7.1.2 |
| 7.0 | 7.0.6 |
| 6.9 | 6.9.9 |
| 6.8 | 6.8.10 |
| 6.7 | 6.7.9 |
| 6.6 | 6.6.9 |
| 6.5 | 6.5.12 |
| 6.4 | 6.4.12 |
| 6.3 | 6.3.12 |
| 6.2 | 6.2.13 |
| 6.1 | 6.1.14 |
| 6.0 | 6.0.16 |
| 5.9 | 5.9.18 |
| 5.8 | 5.8.17 |
| 5.7 | 5.7.19 |
| 5.6 | 5.6.21 |
| 5.5 | 5.5.22 |
| 5.4 | 5.4.23 |
| 5.3 | 5.3.25 |
| 5.2 | 5.2.28 |
| 5.1 | 5.1.26 |
| 5.0 | 5.0.29 |
| 4.9 | 4.9.33 |
| 4.8 | 4.8.32 |
| 4.7 | 4.7.37 |
| 4.6 and older | no fix; these versions no longer receive security updates |
What our check can and cannot tell you
We look at your site from the outside, the way any visitor does. We read the WordPress version your site shows, usually in its generator tag, and compare it with the table above. We do not test the flaw.
- Potentially affected: your site shows a version below the fixed release of its line, or a version older than 4.7. We say potentially because we cannot see your theme or server settings, and a version tag can be out of date.
- Cannot tell: your site runs WordPress but hides the version. We will not guess. Look under Dashboard, Updates, or ask your developer.
- No sign of this problem: your site shows a fixed version, or no WordPress at all. This is "no sign from the outside", not a guarantee.
What to do
- Check your version under Dashboard, Updates in the WordPress admin. Sites with automatic background updates usually updated by themselves.
- Update to the current WordPress release, or at least to the fixed release of your line. Make a backup first.
- If your site ran an affected version for some time after 22 September 2026, ask your developer or host to look for signs of a break-in, such as unknown admin accounts or new PHP files.
- If you run WordPress 4.6 or older, move to a current version. Those versions get no fixes at all.
- Run this check again after the update.
Official sources
- WordPress.org: WordPress 7.1.2 Release and Version 7.1.2 release notes
- WordPress security advisory: GHSA-7hp8-65ch-5whp
- CISA: Known Exploited Vulnerabilities catalog (added 25 September 2026)
- Canadian Centre for Cyber Security: WordPress security advisory AV26-952
Scanylo is not affiliated with WordPress.org or CISA. This page is a plain-language summary, not a replacement for the advisories. This is a passive, external check and not a penetration test.
Why this page exists
This is an earlier wave, kept on the wave radar as background. We added the page afterwards; it was not published when the flaw was disclosed on 2026-09-22. Sites that never updated can still be exposed, so the check still runs.
Every time a major vulnerability wave hits the news, Scanylo publishes a check page within 24 hours. Tick the email alert box above and we will re-check your site on every new wave and tell you the result. It is free and needs no account. The check is passive: we read the version your site shows to any visitor and nothing else. Methodology.