Update WordPress now: a critical flaw is being exploited

If your office or business website runs on WordPress, and many small business sites do, make sure it has been updated. A critical flaw in WordPress itself can, under the right conditions, let an attacker take over the website without logging in. CISA added it to its Known Exploited Vulnerabilities catalog on September 25, 2026.

What to do

Update WordPress to version 7.1.2, or the patched version for the older branch you’re on. WordPress backported the fix all the way to version 4.7, so older sites can update without a major upgrade:

If you’re on	Update to at least
7.1	7.1.2
7.0	7.0.6
6.9	6.9.9
6.8	6.8.10
6.7	6.7.9
6.6	6.6.9
6.5	6.5.12
Older branches (4.7 through 6.4)	The latest release in that branch (for example, 6.4.12 or 5.9.18)

How to check: log in to your WordPress dashboard and go to Dashboard > Updates. It shows your version and any available updates. Many sites update minor versions automatically, but it’s worth confirming, since automatic updates can be turned off.

If someone else runs your website (a web designer, a hosting company, or your IT provider), send them this and ask them to confirm the site is on a patched version.

Who’s most at risk

According to WordPress’s security advisory, a full takeover requires two conditions:

• The site’s theme has a certain folder structure. This includes the older Twenty Twelve and Twenty Fourteen themes and some popular third-party themes such as Neve, Hestia, and Sydney.
• The web server has a particular PHP setting enabled. It’s affected in the official PHP Docker image and in cPanel’s default configuration when running PHP older than 8.5.

You don’t need to figure out whether your site meets those conditions. Just update. It’s the fix either way.

While you’re at it

• Update plugins and themes too. Outdated plugins are one of the most common ways WordPress sites get hacked.
• Remove plugins and themes you don’t use.
• Turn on two-step sign-in for WordPress admin accounts. See turn on two-step sign-in.
• Make sure the site is backed up, so you can restore it if something goes wrong.

Sources

• Unauthenticated path traversal in page-template resolution leading to conditional RCE (WordPress security advisory): affected and patched versions, the conditions for takeover, and the backport to 4.7
• Known Exploited Vulnerabilities catalog (CISA): CVE-2026-87902 added September 25, 2026