WordPress Core Is Experiencing Its Worst Security Year on Record.

Three months. Four named attack chains. All in WordPress core. No plugins involved in any of them.

2026 has been an unusually heavy year for WordPress security, and it hasn’t finished. The most recent flaw, CVE-2026-87902, was patched on September 22. Exploitation started within five hours of the patch dropping. If you haven’t updated since then, your site may already be a target.

This article covers all four named core exploits in order, what each one actually does in plain language, and exactly what you should do right now.

The Short Version: What You Need to Do Right Now

Go to your WordPress admin. Look at the version number in the top left corner of the screen. It should say 7.1.2.

If it says anything else, update immediately via Dashboard > Updates. Don’t assume auto-update ran. The version number is the only confirmation that counts.

If you were running 7.1.1 or earlier between September 22 and today, read the compromise check section below before assuming you’re fine.

July 2026: WP2Shell

The first named exploit of the year landed on July 17. WP2Shell chained two flaws in WordPress core to give an unauthenticated attacker full code execution on a default install. No account needed. No plugins involved. A bare WordPress site with nothing added was exploitable.

The WordPress security team pushed an emergency patch the same day. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21. Exploitation was already active before a public proof-of-concept appeared.

If you want the full breakdown, the detailed writeup is here: WordPress Has a Critical Security Flaw. Update Now.

WP2Shell is patched in WordPress 6.9.5, 7.0.2, and all later versions. If you’re on 7.1.2 as recommended, you’re covered.

August 6: XSS2Shell (CVE-2026-64638)

The second named chain of the year landed three weeks after WP2Shell. XSS2Shell is a pre-authentication reflected cross-site scripting flaw in the WordPress login page. An unauthenticated attacker submits a crafted username to the login endpoint, triggering attacker-controlled JavaScript in the browser of anyone who lands on that page.

On its own that’s serious. The documented escalation path goes further: by manipulating WordPress’s own JavaScript and abusing REST API functionality, the attack can be chained to reach PHP code execution on the server. That step requires a logged-in administrator to interact with an attacker-controlled page, so it’s not the same class of direct threat as WP2Shell or CVE-2026-87902. No in-the-wild exploitation has been confirmed.

WordPress patched XSS2Shell on August 6 in version 7.0.3, with backports to all supported branches down to 4.7.

September 17: Two More Named Chains in WordPress 7.1.1

WordPress 7.1.1 shipped on September 17 with 11 security fixes. Two of them have since been given names by the researchers who found them: Comment2Shell and Click2Shell.

Comment2Shell (CVE-2026-93485)

This one is worth understanding carefully, because the instinctive protection most site owners rely on doesn’t work against it.

An anonymous visitor leaves a comment on your site. The comment looks clean. It passes WordPress’s sanitization check on submission because the malicious part isn’t a script tag or anything obviously dangerous. It’s a newline character placed inside the cite attribute of a standard <blockquote> element.

The problem happens on display. When WordPress renders the stored comment, its wpautop() formatting function processes that newline in a way that leaves attacker-controlled onfocus and autofocus attributes sitting in the markup. When a logged-in administrator views the page, the browser executes that JavaScript automatically under their session. The demonstrated attack path uploads a malicious plugin, giving the attacker code execution on the server.

The reason “we moderate all comments” doesn’t protect you: moderation happens at submission. WordPress checks the comment for dangerous content when it’s saved. The problem is in what happens when it’s displayed, which occurs after moderation approval. A moderated comment can still carry this payload.

Comment2Shell affects WordPress 4.7 through 7.1.0, which is a vast range. It’s fixed in 7.1.1. There’s no sign it has been exploited in the wild.

Click2Shell

The second named chain from the 7.1.1 release is more about what it reveals than the immediate risk level.

A researcher at pwn.ai found that a specially crafted URL, when opened by a logged-in administrator, causes WordPress to silently install and preview a real theme from the official WordPress.org directory. The installed theme stays switched off, so the site looks normal. Nothing changes visually.

On its own, that’s an unusual behavior rather than an immediate disaster. The danger comes from what happens next. When chained with a separate vulnerability in the installed theme, the attacker reaches code execution. The chain was demonstrated using themes whose folder names include a page- prefixed directory. Check whether your active theme contains such a structure if you were running an unpatched version.

Click2Shell requires a logged-in admin to click a malicious link, which limits the attack surface compared to Comment2Shell. It has not been exploited in the wild. The fix is in WordPress 7.1.1.

September 22: CVE-2026-87902, the One Being Attacked Right Now

This is the one to focus on today.

On September 22, WordPress released version 7.1.2 to address CVE-2026-87902, a path traversal flaw in WordPress’s page-template resolution system. Patchstack logged the first exploitation attempt at 11:49 UTC on the same day. By September 23, attack traffic had reached ten times the volume seen on the first evening. CISA issued an alert on September 24. Singapore’s Cyber Security Agency issued a separate alert the same day.

Here’s what the flaw actually does. WordPress has a function called get_page_template() that determines which template file to load when displaying a page. Under certain conditions, an unauthenticated attacker can manipulate that resolution to load a local PHP file from outside the active theme’s directories. This is a local file inclusion (LFI) bug.

On most servers, LFI is serious but not immediately catastrophic. On servers where two specific conditions are true, it escalates to full remote code execution:

Condition one: the top-level directory of your active theme’s folder name starts with page-. If your active theme’s top-level folder name starts with page-, you’re in the higher-risk group. WordPress’s advisory named Neve, Hestia, Sydney, Twenty Twelve, and Twenty Fourteen as examples, but the condition is the folder name itself; check yours directly rather than going by theme name alone.

Condition two: your PHP configuration has register_argc_argv set to On. This is the default in two very common environments: the official PHP Docker image and cPanel installations running PHP below 8.5. If you’re on shared hosting with cPanel and haven’t changed your PHP configuration, check this.

When both conditions are met, attackers can abuse a PHP tool called pearcmd.php to write files to the server, reaching full code execution without ever needing a login. The attack has been confirmed active and escalating.

Notably, this flaw affects WordPress 4.7.0 all the way through 7.1.1, which includes sites that updated specifically to address the September 17 flaws. A site that was updated last week for 7.1.1 still needs this one.

What Version Should You Be Running?

If you’re on the current 7.x branch, the answer is WordPress 7.1.2, released September 22, 2026.

If you’re running an older but still supported branch, the answer is the latest release in that branch. WordPress backported fixes for both the 7.1.1 and 7.1.2 security issues to all supported branches, going back to 4.7. You don’t need to jump to 7.1.2 if you’re intentionally staying on an older version for compatibility reasons. You do need to be on the most recent release within your branch. Check the WordPress releases page to confirm what that is for your branch.

If you’re on WordPress 4.6 or below, no patch exists. WordPress no longer backports security fixes to branches below 4.7. The only real option is upgrading to a current, supported version.

To check your version, go to your WordPress admin dashboard. The version appears in the bottom-right corner of the Dashboard > Home screen. Alternatively, go to Dashboard > Updates, and it shows there.

To update: click “Update Now” in Dashboard > Updates if the update hasn’t run automatically. On managed WordPress hosting, check whether your host applied it automatically and confirm the version number directly rather than assuming.

What to Do and How to Stay Updated

Check your version manually, even if auto-update is on.

Auto-update is helpful but not infallible. Some hosts disable it. Some configurations block it. Cloudflare caching can occasionally cause the admin to show a cached version. The number in your WordPress admin is the only reliable confirmation. This matters because CVE-2026-87902 went from patch to active exploitation in under five hours. Assuming the update ran is not the same as knowing it ran.

Check your active theme’s folder name.

Go to your hosting file manager or FTP and look at the folder name for your active theme inside wp-content/themes/. If it starts with page-, you were in the higher-risk group for CVE-2026-87902 before patching. That’s the actual condition WordPress’s advisory describes, not just the example themes named in coverage of the flaw. That doesn’t mean you were compromised, but patching and checking for signs of compromise are both worthwhile.

Check your PHP configuration if you’re on cPanel or Docker.

If you manage your own server or hosting environment, look at whether register_argc_argv is set to On in your php.ini. On cPanel with PHP below 8.5, it defaults to On. Setting it to Off removes the escalation path from LFI to RCE. On managed hosting, your host handles this. It’s worth asking them directly if you’re unsure.

Scan for signs of compromise if your site ran 7.1.1 or earlier between September 22 and today.

Look for unexpected PHP files in wp-content/uploads/. That directory isn’t supposed to contain executable PHP files. Look for administrator accounts you didn’t create. Look for plugins you didn’t install. Review your server access logs for unusual requests to template-related paths. If you find anything suspicious, restoring from a backup taken before September 22 is safer than trying to clean a compromised install.

Enable comment moderation if it isn’t already on, and keep it on.

Comment2Shell is patched in 7.1.1. Moderation didn’t fully protect against it, but it did reduce the window of exposure. Having comments require approval means an attacker can’t have their payload sitting on a public page indefinitely. It’s one layer, not a complete defence.

Follow a reliable source for WordPress security news.

The window between a patch being released and active exploitation beginning is now routinely less than 24 hours. Checking for updates once a week isn’t frequent enough if your site is actively targeted. Sources worth following: the WordPress.org News blog for official release announcements, Patchstack for detailed CVE analysis and exploitation timelines, and WP Tavern for broader WordPress ecosystem news. Setting up a simple email alert for new WordPress releases takes five minutes and means you know within hours rather than days.

Questions Worth Answering

What version of WordPress should I be running right now?
WordPress 7.1.2, released September 22, 2026, if you’re on the current branch. If you’re on an older but still supported branch, update to the latest release in that branch. Branches below 4.7 no longer receive security fixes and should be upgraded.

My site has auto-updates enabled. Am I safe?
Possibly, but verify. Auto-updates can be blocked by hosting configurations, caching, or server-level restrictions. Check the version number directly in your dashboard. If it shows 7.1.2 (or the latest release in your supported branch), you’re patched for all four named exploits covered here.

Does Cloudflare protect against CVE-2026-87902?
Cloudflare’s WAF can block known payload patterns, and Cloudflare issued mitigations for the vulnerable code path. That said, WAF rules protect against known attack signatures. An updated WordPress installation is the reliable fix. Don’t treat a WAF as a substitute for patching.

How do I check if my WordPress site has been compromised?
Check wp-content/uploads/ for PHP files. Check your user list for administrator accounts you don’t recognize. Remove any plugins you don’t recognize. Review your server access logs for unusual requests to template-related paths. If you find anything suspicious, restoring from a backup taken before September 22 is safer than trying to clean a compromised install.

Does managed WordPress hosting protect me from these vulnerabilities?
It helps significantly. Managed WordPress hosts like Kinsta and Rocket.net apply WordPress core updates automatically and often within hours of release. Some apply WAF rules at the server level before patches are even available. That shortens the exposure window considerably compared to a self-managed site. It doesn’t eliminate the need to verify your version, but it does mean you’re less likely to spend days on an unpatched version.

The Bigger Picture

Four named attack chains in WordPress core in under three months. WP2Shell in July. XSS2Shell in August. Comment2Shell and Click2Shell on September 17. CVE-2026-87902 on September 22.

The pattern that matters most isn’t the vulnerabilities themselves. It’s the speed. Between patch and active exploitation, the gap is now measured in hours, not days. Attackers are reading security advisories and patch diffs at the same time defenders are. By the time most site owners hear about a flaw, scanners are already looking for it.

That changes what keeping WordPress updated actually means in practice. It means checking your version after every release, not just when something sounds serious. It means having a baseline of what your site looks like when it’s healthy, so deviations are visible. Furthermore, it means treating your hosting setup, your update schedule, and your security practices as the same problem, not three separate ones.