On September 17 your dashboard said "updated." On September 22 it needs to say that again. This time the flaw needs no admin click at all.
On September 22, 2026, WordPress shipped version 7.1.2, a security-only release with exactly one fix — and it is the most serious thing WordPress has patched in a while (Patchstack, Sep 22, 2026). The flaw, tracked as CVE-2026-87902 with a CVSS score of 9.2 out of 10, lets an attacker with no account on your site make it load a PHP file from outside its theme folders. On some server setups that goes further, letting the attacker run code on your server. WordPress's own release post says it plainly: update your sites immediately (WordPress, Sep 22, 2026).
Here is the part that stings. Every version from 4.7.0 through 7.1.1 is affected — and that range includes 7.1.1, the Click2Shell security release from September 17 (The Hacker News, Sep 22, 2026). If you updated five days ago and felt safe, this is a second emergency update for a separate flaw the first one did not fix. There is no workaround. Updating is the fix.
What happened
When someone visits a page on your WordPress site, WordPress picks a template file to render it. One of the candidate filenames is built from part of the page's web address — request input, straight from the visitor. On affected versions, that value was never run through WordPress's own check for ../ traversal steps, even though the neighboring line of code used exactly that check on a different value (Patchstack, Sep 22, 2026). The protection existed three lines above the place it was missing. The 7.1.2 fix does two things: it applies the missing check, and it adds a broader guard requiring every resolved template file to sit inside an allowed theme folder — WordPress treated this as a whole class of problem, not one bad line (Patchstack, Sep 22, 2026).
Because the filename is assembled as page-{value}.php, a working attack needs your active theme to carry a top-level folder whose name starts with page-, such as page-templates. Older default themes like Twenty Twelve and Twenty Fourteen ship one, and so do some popular third-party themes including Neve, Hestia, and Sydney. The current default themes do not (GitHub Advisory GHSA-7hp8-65ch-5whp, Sep 22, 2026).
Loading a local PHP file runs whatever that file already does. Turning that into the attacker's code needs a second condition on the server: a readable PHP file that does something useful when loaded. The well-known route is through PEAR's pearcmd.php, and it depends on a PHP setting called register_argc_argv being turned on. That setting is on by default on PHP versions before 8.5, affects the official PHP Docker images, and affects default cPanel setups running older PHP (GitHub Advisory; The Hacker News, Sep 22, 2026).
Put plainly: the flaw is in every affected site, but the worst case — full code execution — lands only where an older theme folder and an older PHP configuration line up. You cannot know which side of that line your site is on from the dashboard, which is why the update applies to everyone.
The flaw was found by Robert Ressl, who reported it privately through WordPress's HackerOne program on July 20, 2026 and published a detailed write-up with a proof-of-concept and reproducible lab when the fix shipped (Ressl, Sep 22, 2026). His demonstrated chain ran against WordPress 7.0.2 in isolated local labs, executing code with the web-server account's privileges — serious, but not full server control, and tested against lab setups only, never live sites. A published proof-of-concept is not the same as real attacks: as of September 22 there were no reports of the flaw being exploited in the wild, and it had no entry in the U.S. CISA catalog of exploited vulnerabilities (The Hacker News, Sep 22, 2026).
Why shop owners should care twice
Two core scares five days apart is the story. Last week's Click2Shell chain needed a logged-in admin to click a crafted link — one careless click from one staff member. This week's flaw needs nothing from anyone: no account, no click, no help from your team. An attacker just sends requests directly at your site. For a shop, that difference matters. Click-based attacks can be blunted by careful staff. This one cannot be blunted by behavior at all. Only the patch closes it.
The second reason is quieter. Security vendor Patchstack notes two checks that show how close a site is to the worst case: whether the active theme has that top-level page- folder, and whether PHP runs with register_argc_argv on (Patchstack, Sep 22, 2026; The Hacker News, Sep 22, 2026). Both are things a shop owner inherits without choosing — a theme picked years ago, a PHP default set by the host. Neither check is a fix, Patchstack stresses. But they explain why two shops on the same WordPress version can face different risk from the same flaw, and why "we're too small to be targeted" is the wrong comfort: automated scanners do not check your revenue before probing.
What to do
Update first, verify second. In your WordPress dashboard go to Updates and click Update Now, or download the release from WordPress.org. Which version you need depends on the branch you run: 7.1.x goes to 7.1.2, 7.0.x to 7.0.6, 6.9.x to 6.9.9, 6.8.x to 6.8.10, 6.7.x to 6.7.9, 6.6.x to 6.6.9, with fixes backported all the way to 4.7.37 (The Hacker News, Sep 22, 2026). If your site supports automatic background updates, the update begins on its own — but confirm it actually landed. Dashboard version numbers are the ground truth: anything at or below 7.1.1 on the 7.1 line is still vulnerable.
Then check the two exposure signals, not as fixes but as knowledge. Ask your developer or host whether your active theme carries a top-level folder starting with page-, and whether PHP runs with register_argc_argv on. If the answer to both is yes, treat this update as the highest priority job today — your site was in the directly-exploitable group. Turning that PHP setting off for web requests and removing unused PEAR components shrinks the route to code execution — both Ressl and Patchstack recommend these steps — but neither repairs the underlying flaw (Ressl, Sep 22, 2026; Patchstack, Sep 22, 2026). They are seatbelts, not brakes.
Finally, close the loop on auto-updates. The shops that sailed through this week with no action are the ones whose background updates already moved them from 7.1.1 to 7.1.2 overnight. In the dashboard, confirm automatic updates are enabled for minor and security releases, and make a habit of glancing at the version number the morning after any security announcement. Two emergency releases in five days is unusual. The habit of verifying the morning after is what makes the next one boring.
A compromised shop does not just lose a day of sales. Customer names, addresses, and order histories sit in the same database the web server can reach, and cleanup plus lost trust costs far more than a five-minute update. If the version number is the only thing standing between an unauthenticated stranger and your server, go read it now.
Is your site ready? Run a free security scan — 40+ automated checks, instant results, no commitment.