Grade One Press

Technology reporting you can check

News · Security & privacy

Attackers are exploiting a flaw in WordPress itself, US cyber agency says; fixes go back to version 4.7

The flaw can let an unauthenticated attacker run code on some sites, depending on the theme and server set-up. WordPress released fixes on 22 September; CISA listed it as exploited on 25 September.

Catching up: the original came out on . This story was published later, when the site opened.

Grade One Newsroom · 1 min read

Sources: 2 · top grade 1How evidence is graded

A flaw in WordPress's core software is being exploited, the US cyber agency says

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
CISA added a critical WordPress core flaw to its list of vulnerabilities being exploited, three days after WordPress released fixes.
Who it affects
Sites running WordPress 4.7 to 7.1.1 whose theme has a folder named page-something and whose server has a usable PHP file, such as a default PEAR install.
What it does not tell you
How many sites are vulnerable or were attacked. Neither CISA nor WordPress gives a count.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency added a flaw in WordPress's core software to its catalogue of vulnerabilities being exploited on 25 September, giving federal agencies until 28 September to deal with it [1].

The flaw lets an unauthenticated attacker make WordPress include a chosen PHP file from outside the theme's folders, which can lead to remote code execution [1][2].

WordPress rated it critical and released fixes on 22 September: version 7.1.2, with the fix backported to every branch since 4.7 [2].

What it covers

Sites running WordPress 4.7 up to 7.1.1, but only when two conditions are met [2].

The active theme must have a top-level folder whose name starts with page-. WordPress says that includes its older Twenty Twelve and Twenty Fourteen themes, and third-party themes such as Neve, Hestia and Sydney [2].

And a usable PHP file must be readable on the server. WordPress names PEAR's pearcmd.php when a PHP setting called register_argc_argv is on, which it says affects the official PHP Docker image and cPanel's default set-up with PHP before 8.5 [2].

What it does not tell you

How many sites meet the conditions, or how many have been attacked. Neither source gives a number [1][2].

Who is exploiting it. CISA's entry does not say [1].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entry CVE-2026-87902. Read 29 September 2026. Grade 1 · Primary Added 25 September 2026, due 28 September for US federal agencies. A listing means CISA has evidence of exploitation.
  2. WordPress, security advisory on GitHub, Unauthenticated path traversal in page-template resolution leading to conditional RCE (GHSA-7hp8-65ch-5whp). Read 29 September 2026. Grade 3 · Filed record The project's own disclosure, published 22 September 2026, rated critical. It lists the affected and fixed versions.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Vulnerabilities WordPress

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all