On 22 September 2026, WordPress released version 7.1.2 to patch a critical security flaw (CVE-2026-87902) which affected every version of WordPress core released since 2016. Rated 9.2 out of 10 for severity, the vulnerability allows an attacker to remotely access and execute files on a vulnerable site without needing a username, password, or any interaction from a real user at all.
If that sounds alarming, it should. If you’re a business owner running a WordPress site, there’s a reasonable chance you didn’t hear about it — and an even better chance you don’t know whether your own site has been updated to fix it.
You’re not alone. WordPress now powers 40.7% of all websites on the internet which equates to six in ten of every site built on an identifiable content management system . That scale is exactly why vulnerabilities like this one matter so much – when a flaw is found in WordPress core, it doesn’t just affect a handful of sites, it potentially affects millions, all at once, all over the world.
Why this keeps happening — and why it’s accelerating
Security vulnerabilities in software aren’t new but what has changed is the pace at which they’re being found and exploited. Industry data from 2026 shows disclosed vulnerabilities across enterprise software rose by 92% in a single year, with critical and high-severity flaws more than doubling.
A big part of that shift is AI. Security researchers increasingly use AI tools to identify vulnerabilities faster than ever — but so do attackers. CrowdStrike’s 2026 Threat Hunting Report found that 88% of observed attacks exploiting a publicly known vulnerability happened within 48 hours of that vulnerability becoming public knowledge, with some attackers moving in under 24 hours. The window between “a fix exists” and “attackers are actively exploiting anyone who hasn’t applied it” is shrinking fast — and for this latest vulnerability, working proof-of-concept exploit code was circulating publicly within a day of disclosure.
Does your website remain vulnerable?
If you currently have your own WordPress website this raises a couple of important questions – were you even aware of the vulnerability and would you know what to do to safely fix it?
Do you currently have someone looking after your site for you and do you know for sure they are doing what they need to do to protect your site? Or, even worse, is it all up to you to fix? Issues like this often fall through the cracks because nobody’s actively watching for them.
This isn’t a scare story designed to sell you something you don’t need, it’s simply the reality of running a website in 2026. The tools attackers use are getting increasing more powerful and the volume of vulnerabilities is escalating. A website which isn’t being actively managed is a website which is quietly accumulating risk — often invisibly, until something goes wrong.
The good news is that this is a solved problem, and solving it doesn’t need to fall on your shoulders. A managed website is one where core and plugin updates are applied as a matter of course, where security monitoring flags issues before they become incidents, where backups exist so a worst case is a recoverable one rather than a catastrophic one, and where a professional is taking care of it all so you don’t have to.
If you are running a WordPress website and don’t have someone actively and professionally managing it for you then we are here to help. Our Website Management Service is specifically designed for these circumstances so if you want to ensure the security and integrity of your site and its data then why not get in touch with our team to see how we can help?
