WordPress Patches Critical Core Vulnerability CVE-2026-87902 Affecting All Versions from 4.7.0
WordPress has issued security updates that address a critical vulnerability in the platform's core, identified as CVE-2026-87902 and rated CVSS 9.2. The flaw affects all versions from 4.7.0 to 7.1.1, leaving the vast majority of installations exposed until the latest patches are applied.
The vulnerability exists in the base code rather than in any plugin or theme. This means sites running a clean installation with no additional extensions are still at risk. An attacker can load a PHP file located outside the designated theme directories. Under specific server configurations, this capability can be leveraged to execute arbitrary code chosen by the attacker.
Exploitation requires no authentication and no interaction from any logged-in user, making the attack surface available to any visitor. The absence of required credentials significantly increases the severity of the issue.
Patch Releases
Security updates have been distributed across all currently supported branches:
- 7.1.x → version 7.1.2
- 7.0.x → version 7.0.6
- 6.9.x → version 6.9.9
- 6.8.x → version 6.8.10
- 6.7.x → version 6.7.9
- 6.6.x → version 6.6.9
- Support extends back to 4.7.37
The vulnerability was reported in July by researcher Robert Ressl via a private disclosure on HackerOne and made public on 22 September. No evidence of active exploitation in the wild has been recorded to date.
Site owners are strongly advised to update immediately and ensure automatic updates remain enabled. For environments where immediate patching is not feasible, temporary mitigations include disabling register_argc_argv and removing unused PEAR components.
Related articles
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.
Windows 11 Update KB5124010 Triggers Crashes in Battlefield 6 and Other Titles
An optional non-security update KB5124010 for Windows 11 versions 24H2 and 25H2 is causing sudden game crashes for players of Battlefield 6, Battlefield 2042, and titles using Easy Anti-Cheat. The patch, initially distributed to Windows Insider participants and later made available broadly in early September, leads to silent exits within 15-30 seconds or a few minutes after launch. Reinstalling games, verifying DirectX installations, and repairing anti-cheat components have failed to resolve the issue, while uninstalling KB5124010 has restored functionality in multiple cases. The crashes are suspected to stem from conflicts with anti-cheat systems, including Electronic Arts' Javelin used in Battlefield titles and Easy Anti-Cheat in games such as Wardogs, which reports error WD-L020-95bc94d86a0d. Microsoft has not officially confirmed any link to anti-cheat software, and the problems affect users across diverse hardware configurations. Players are advised to skip the optional update until further clarification or a fix is provided.
WordPress Issues Critical Security Update 7.1.2 Five Days After Previous Patch
WordPress has released version 7.1.2 to fix a new critical vulnerability that was not addressed in the 7.1.1 update issued just five days earlier. The flaw, tracked as CVE-2026-87902, is a path traversal issue rated Critical that can be exploited without authentication. It resides in the page template resolution process and allows execution of arbitrary local PHP files located outside the theme directory, provided certain conditions such as the presence of a page- prefixed directory in the parent or child theme are met. The update was published on September 22, 2026, and affects the prior release from September 17. Administrators are urged to apply the patch immediately to prevent potential remote code execution.