24/09/2026
Thought I'd share this in case it helps someone.
Check with your own hosting platforms.
We are contacting you about a critical security update for WordPress. If any of your websites use WordPress, we strongly recommend that you update it as soon as possible.
The vulnerability (CVE-2026-87902) affects WordPress versions 4.7.0 to 7.1.1. It can be exploited and attackers have already started scanning for vulnerable sites. Please update any WordPress websites you manage today.
The patched version is WordPress 7.1.2. If you are on an older version, a patched release is also available for your branch (for example 7.0.6, 6.9.9 or 6.8.10). Sites with automatic updates switched on may already be updated, but please check.
As well as updating WordPress, we recommend checking whether the PHP setting register_argc_argv is enabled for your websites. If you don't need it, switching it off removes the main way this flaw can be used to run code on your server.