The WordPress PHP Code Breach: Is Your Website at Risk? (CVE-2026-87902)

Introduction: A Critical WordPress Security Vulnerability You Shouldn’t Ignore

WordPress powers millions of websites worldwide, making it one of the most widely used content management systems on the internet. But its popularity also makes it an attractive target for cybercriminals.

In September 2026, a serious security vulnerability identified as CVE-2026-87902 was disclosed in WordPress Core. The vulnerability could allow unauthenticated attackers to access and include certain local PHP files outside the active theme directories. Under specific server and theme conditions, this could potentially lead to Remote Code Execution (RCE).

What makes this incident particularly concerning is that attackers do not necessarily need a WordPress administrator account to attempt exploitation.

The WordPress development team released a security update on September 22, 2026, and cybersecurity authorities subsequently confirmed that the vulnerability was being actively exploited.

According to the Canadian Centre for Cyber Security, the vulnerability was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) Catalog on September 25, 2026.

But what does this actually mean for your website?

Could your WordPress theme or plugins make your website vulnerable? Does having premium plugins protect you? And what should you do if your website is still running an older WordPress version?

In this guide, EG-WP explains the vulnerability, its potential impact, the affected versions, and the practical steps you should take to protect your website.

1. What Is the WordPress PHP Code Breach (CVE-2026-87902)?

CVE-2026-87902 is a high-severity vulnerability affecting WordPress Core, specifically the way WordPress resolves page templates.

The vulnerability involves the get_page_template() function, which is responsible for determining which PHP template file WordPress should use when displaying a page.

Under certain conditions, an unauthenticated attacker could manipulate template resolution to make WordPress include a readable local PHP file located outside the active theme directories.

If the required server and theme conditions are present, this file inclusion could lead to Remote Code Execution.

In simpler terms, an attacker could potentially trick a vulnerable WordPress installation into loading a PHP file that should not normally be included through the page-template process.

If that PHP file contains executable malicious code, the consequences could be serious.

Why is this important?

Because PHP is the programming language behind WordPress. It powers the platform’s core functionality, themes, plugins, and many custom website features.

If an attacker manages to execute unauthorized PHP code on a website’s server, they may potentially:

• Modify website files and content.

• Install malicious scripts or backdoors.

• Access sensitive website information.

• Create unauthorized administrator accounts.

• Redirect visitors to malicious websites.

• Disrupt website functionality.

• Compromise other resources accessible through the hosting environment.

These are potential consequences of successful exploitation, not outcomes that automatically occur on every vulnerable website.

The official WordPress security announcement confirms that exploitation depends on specific conditions involving both the server environment and the active theme.

2. How Serious Is the Vulnerability?

This is not simply a minor WordPress bug.

CVE-2026-87902 received a CVSS 3.1 score of 8.1 out of 10, placing it in the High severity category.

The absence of an authentication requirement is particularly important. It means attackers do not necessarily need legitimate WordPress login credentials to attempt exploiting the vulnerability.

Additionally, the Canadian and Singaporean cybersecurity authorities reported active exploitation, making this an issue that website administrators should address rather than postpone.

3. Which WordPress Versions Are Affected?

According to the official WordPress security announcement and subsequent cybersecurity advisories, versions earlier than WordPress 7.1.2 are affected.

The security fix was released on September 22, 2026.

Importantly, WordPress did not limit the fix to the latest version. The development team also backported the security patch to eligible older branches, going back to version 4.7.

Here is a practical overview:

Important: The version number alone is not enough to determine whether your website has been compromised. You should verify that the installed release contains the security patch and check for signs of unauthorized activity.

You can check your WordPress version by following these steps:

1. Log in to your WordPress dashboard.

2. Navigate to Dashboard → Updates.

3. Check your currently installed WordPress version.

4. Install the latest available security and maintenance release.

5. Confirm that the update completed successfully.

You can also consult the official WordPress 7.1.2 security release announcement.

4. Does the Vulnerability Affect WordPress Themes and Plugins?

This is probably the most important question for website owners who rely on premium WordPress themes and plugins.

The short answer is: The vulnerability affects WordPress Core, but themes and server configurations can influence whether exploitation is possible.

CVE-2026-87902 is not officially identified as a vulnerability in a particular commercial theme or plugin.

However, the official advisory specifically identifies conditions involving the active theme and server environment.

For example, certain theme directory structures can contribute to the conditions required for exploitation.

This means that even if your theme is legitimate, regularly updated, and purchased from a reputable developer, your website could still be exposed if its WordPress Core installation is vulnerable.

Can premium WordPress themes cause the problem?

Not necessarily.

A premium theme is not automatically vulnerable simply because it contains PHP files or custom templates.

The important distinction is between:

• A vulnerability in WordPress Core.

• A vulnerability within a theme’s own code.

• A server configuration that makes exploitation possible.

• A combination of these conditions.

These are different security issues, and they should not be confused.

What about WordPress plugins?

The same principle applies to plugins.

The vulnerability is in WordPress Core, not a confirmed flaw in every installed plugin.

However, plugins can introduce additional security risks if they are outdated, poorly maintained, or contain vulnerable PHP code.

For website owners, this reinforces an important security principle: keeping WordPress updated is just as important as keeping themes and plugins updated.

5. How Can Attackers Exploit This Vulnerability?

To understand the risk, it helps to understand the general mechanism behind the vulnerability.

WordPress uses PHP templates to generate website pages. When visitors access a page, WordPress determines which template should handle the request.

CVE-2026-87902 involves weaknesses in the page-template resolution process.

Under the necessary conditions, an attacker can manipulate this process to cause WordPress to include a readable PHP file outside the normal active theme directories.

If the conditions required for remote code execution are also present, the attacker may be able to execute unauthorized PHP code.

The Singapore Cyber Security Agency confirmed that a publicly available proof-of-concept existed and that exploitation was being reported in the wild.

6. Real-World Evidence: Attackers Started Targeting WordPress Websites

One of the most important aspects of CVE-2026-87902 is that exploitation attempts were observed shortly after the security patch was published.

This is not just a theoretical vulnerability.

Security researchers at Patchstack published an investigation documenting the attack activity they observed through their security infrastructure.

Their findings provide some important real-world evidence.

What happened after the patch?

Patchstack reported that its first observed exploitation attempt arrived at 11:49 UTC on September 22, 2026, the same day WordPress released version 7.1.2.

Initially, most observed requests were reconnaissance attempts designed to identify potentially vulnerable websites.

However, the situation escalated.

By September 23, researchers reported attempts to use the vulnerability to write PHP files to server storage. They also observed publicly circulating scanning tools and a substantial increase in attack traffic.

The researchers described three broad stages:

1. Reconnaissance: Attackers attempted to determine whether websites were vulnerable.

2. Environment testing: Some requests attempted to identify whether the server conditions required for further exploitation were present.

3. Code execution attempts: Researchers observed attempts to write PHP files to the server.

Patchstack also reported that traffic had spread from a small cluster of IP addresses to a few hundred addresses. This is why relying exclusively on blocking individual IP addresses is not a reliable long-term solution.

What does this mean for website owners?

Even if your website has not shown visible problems, it may have received malicious requests.

A website can be scanned without being compromised. However, websites that were running vulnerable versions during the attack period should be checked carefully, especially if they were exposed to the internet.

7. What Could Happen If Your WordPress Website Is Compromised?

The impact of successful Remote Code Execution can extend beyond a few broken pages.

Depending on the attacker’s access and the hosting environment, a compromised WordPress installation could experience several problems.

1. Malicious PHP code

Attackers may introduce unauthorized PHP files that execute unwanted actions on the website.

These files can be used to maintain unauthorized access or interfere with normal website operations.

2. Unauthorized administrator accounts

An attacker who gains sufficient access may create additional administrator accounts, making it harder for the legitimate website owner to regain control.

3. SEO spam and malicious redirects

A compromised website may start displaying unwanted advertisements, spam pages, or redirects to suspicious external websites.

This can damage search engine visibility and negatively affect visitors’ trust.

4. Customer and business data exposure

If the attacker gains access to sensitive website information, customer details, contact forms, and other business data could potentially be exposed.

This is particularly concerning for WooCommerce stores and websites that collect customer information.

5. Website downtime

Malicious changes to PHP files or other website components may cause errors, broken functionality, or complete website downtime.

For an online business, this could mean lost sales, damaged reputation, and additional recovery expenses.

The important distinction is that these are potential consequences of a successful compromise, not automatic effects of merely running an affected WordPress version.

8. How to Protect Your WordPress Website Against CVE-2026-87902

The good news is that WordPress has already released a security fix.

You do not need to rebuild your website or replace your existing theme and plugins simply because this vulnerability was discovered.

However, you should take the following precautions.

Step 1: Update WordPress Core

This is the most important action.

Navigate to:

WordPress Dashboard → Updates → Update Now

Install the latest available security release for your WordPress branch.

For reference, the security fixes include:

These are the initial patched releases documented by Patchstack. Later maintenance releases may also contain the fix. Always choose the latest available release for your branch.

Step 2: Update Your WordPress Themes

Outdated themes can introduce additional security problems.

Check your installed themes and:

• Install available security updates.

• Remove themes you no longer use.

• Download updates from the original developer or authorized source.

• Avoid modified or unofficial theme packages.

A legitimate premium theme is not automatically immune to security vulnerabilities. Regular updates remain essential.

Step 3: Update Your WordPress Plugins

Plugins extend WordPress functionality, but outdated plugins can become potential entry points for attackers.

Review your installed plugins and:

• Update all plugins to their latest compatible versions.

• Remove inactive plugins you no longer need.

• Verify the source of premium plugin packages.

• Check whether developers have published security advisories.

• Avoid plugins that have been abandoned or are no longer maintained.

Step 4: Review Your Website for Suspicious Activity

Updating WordPress prevents exploitation through the patched vulnerability, but it does not automatically remove malware that may already have been installed.

If your website was running a vulnerable version during the exploitation period, consider conducting a security review.

Pay particular attention to:

• Unexpected administrator accounts.

• Recently modified PHP files.

• Unknown files in temporary server directories.

• Unfamiliar scheduled tasks.

• Suspicious redirects.

• Unexpected changes to website content.

• Unusual login and server activity.

If you find evidence of unauthorized code execution, contact your hosting provider or a qualified WordPress security specialist.

Step 5: Maintain Regular Backups

Backups are an essential part of website security.

Keep recent backups of:

• WordPress core configuration.

• Themes and plugins.

• Website uploads.

• The WordPress database.

Ideally, maintain at least one backup outside your hosting account.

Remember that restoring a backup is not a substitute for fixing the vulnerability. Otherwise, your website may become vulnerable again.

Step 6: Use Trusted Security Tools

A WordPress security plugin can help monitor suspicious activity, detect malicious files, and identify certain security problems.

Popular options include:

• Wordfence.

• Solid Security.

• Sucuri.

These tools can provide additional protection, but they should complement—not replace—WordPress security updates.

9. Does Buying Premium WordPress Themes and Plugins Protect Your Website?

This is an important distinction that many WordPress users misunderstand.

Purchasing a premium theme or plugin does not automatically make your website secure.

However, obtaining genuine products from legitimate developers gives you access to the official product updates, bug fixes, and security improvements provided by those developers.

Consider the difference:

A premium product can still contain vulnerabilities. No reputable developer can guarantee that software will never have a security issue.

The important thing is to use trustworthy sources and maintain updated versions.

Why legitimate activation matters

For WordPress website owners, activation is not just about removing an activation notice.

Depending on the product and its licensing system, legitimate activation can provide access to:

• Official product updates.

• Developer support.

• License-related features.

• Compatibility improvements.

• Security fixes.

At EG-WP, our focus is helping WordPress users access and activate themes and plugins while understanding the importance of maintaining their websites properly.

Remember: Genuine plugin and theme activation does not replace WordPress Core security updates. Both are necessary parts of a healthy WordPress installation.

10. Frequently Asked Questions About the WordPress PHP Breach

Is my WordPress website affected by CVE-2026-87902?

Your website may be vulnerable if it was running an affected, unpatched WordPress version.

However, successful exploitation also depends on specific theme and server conditions. Updating WordPress to a patched release is the recommended action.

Can hackers attack my WordPress website without logging in?

Yes. CVE-2026-87902 is an unauthenticated vulnerability, meaning an attacker does not necessarily need WordPress login credentials to attempt exploitation.

Do I need to delete my current WordPress theme?

No. There is no general requirement to delete your theme because of this vulnerability.

Update WordPress Core, maintain your theme, and investigate any suspicious activity.

Are premium WordPress plugins safe?

Premium plugins are not automatically safe or immune to vulnerabilities.

Their security depends on code quality, maintenance, update availability, and the integrity of the package you install.

Does updating my plugins fix CVE-2026-87902?

No. This vulnerability was fixed in WordPress Core.

Updating plugins is important for overall security, but you must also install the appropriate WordPress Core security release.

Can a website be hacked even after updating WordPress?

Yes. If attackers compromised the website before the update, malicious files or unauthorized accounts may remain.

Updating closes the vulnerability but does not guarantee that an existing infection has been removed.

Is WordPress still safe to use?

Absolutely. This incident does not mean WordPress is inherently unsafe.

Security vulnerabilities are discovered and fixed in many software platforms. The important thing is to install security updates promptly, use trusted extensions, and maintain regular backups.

Conclusion: Don’t Let an Outdated WordPress Installation Put Your Website at Risk

The CVE-2026-87902 vulnerability is a serious reminder that website security requires continuous attention.

With a CVSS score of 8.1, confirmed exploitation reports, and attack activity observed shortly after the security patch was released, this incident deserves attention from every WordPress website owner.

The most important action is straightforward: update WordPress Core to a patched version, keep your themes and plugins updated, and investigate suspicious activity if your website was previously exposed.

Whether you operate a personal blog, business website, WooCommerce store, or professional agency website, maintaining trusted and updated WordPress software is essential.

At EG-WP, we believe that a successful WordPress website starts with reliable tools, legitimate product activation, and responsible website maintenance.

Explore our WordPress themes and plugins, keep your website updated, and build a better and more secure WordPress experience.