WordPress sites running versions 4.7.0 through 7.1.1 are exposed to a critical flaw that allows arbitrary code execution on the web server, tracked as CVE-2026-87902. A patch shipped on September 22, and exploit attempts began surfacing within hours of its release. Companies are being advised to update immediately.
The vulnerability lets an attacker include an arbitrary PHP file without authorization, though the file must already be present on the targeted server. Under certain WordPress and PHP configurations, that can lead to arbitrary code execution. Most publications classify CVE-2026-87902 as a remote code execution bug.
The only fix is installing the latest version, which for most sites means 7.1.2 or newer. Updates have been released for all supported branches, and WordPress published a patched version table along with affected version data on its GitHub page.
A researcher has offered hardening tips as a complement to the patch, not a replacement for it. The Hacker News has published IP addresses and PHP filenames linked to the attacks, signs that a WordPress instance may already be compromised. Kaspersky also advises companies to keep centralized vulnerability management running, given how quickly attacks followed the patch.
The disclosure lands roughly five months after a separate critical flaw in GitHub, CVE-2026-3854, was disclosed by Wiz researchers and rated CVSS 8.7. That bug affected GitHub.com and GitHub Enterprise Server, plus Enterprise Cloud deployments using Data Residency or the Enterprise Managed Users option, with Wiz reporting it to GitHub on March 4. GitHub.com was fixed within six hours, and Enterprise Server patches followed on March 10.
Nearly two months later, 88% of Enterprise Server instances were still vulnerable, a reminder that patching windows can stretch far beyond the initial fix. The GitHub flaw exploited an injection issue in an internal X-Stat header, where git push options were copied into the header without sanitizing semicolons, and the exploitation chain required three injections. GitHub said it found no evidence of exploitation in the wild.
That finding, one of the first critical flaws discovered in closed-source binaries using AI-improved tooling, was made with Wiz's IDA MCP automated reverse engineering. GitHub CISO Alexis Wales called the finding rare, and it earned one of the highest Bug Bounty rewards.
What the Kaspersky post does not say is how many sites remain unpatched or whether any compromise has been confirmed beyond the attack indicators circulating publicly.
