Filed under: Cybersecurity · Website Security · September 2026

What happened

On September 22, WordPress released version 7.1.2 to fix a critical flaw in WordPress itself, not in an add-on plugin (CVE-2026-87902). Under certain conditions, it lets an attacker with no login run their own code on your web server, which means taking over the site. Security researchers saw the first scans for it within hours of the fix coming out. By September 23, attacks were up tenfold and some were planting files that run commands on hacked sites.

Why it matters to your business

Many Phoenix small businesses run their website on WordPress, often on shared cPanel hosting. That’s one of the setups these attackers are going after. A hacked site can send your visitors to scam pages, steal what customers type into your contact or payment forms, or get your domain flagged by Google and email filters. The attack only fully works when certain server and theme settings line up. But every WordPress version from 4.6 through 7.1.1 has the flaw, so don’t assume you’re safe. Check.

What to do this week

1) Log in to your WordPress admin and go to Dashboard → Updates. The version you’re running is listed at the top. If it isn’t 7.1.2 (or the latest security release for your older branch, such as 7.0.x or 6.x), click Update Now. 2) If your site normally updates itself, still check the version. Some hosts and security plugins turn automatic core updates off. 3) If a web designer or agency runs the site, email them today and ask them to confirm the version in writing. 4) Anything older than 4.7 gets no fix at all. Plan a rebuild or upgrade right away. 5) Ask your host to look in the /tmp and /var/tmp folders for unfamiliar .php files (names like wp-pear-rce-flag.php or poc87902.php have been seen) and to review the access logs from September 22 onward. 6) Make sure you have a recent backup stored somewhere other than your web host.

The bigger picture

Attackers now turn a published fix into working attacks within a day, so waiting to patch until you have a free moment is no longer safe. Your website needs the same routine patching as your office PCs. → Proactive vs. Reactive IT Management: Lessons from Healthcare for SMBs

Not sure who’s keeping your website patched? Book a free consult → https://micro1tech.com/contact/