A CVSS 9.2 path traversal, patched September 22, affects every WordPress install from 4.7 through 7.1.1 — including the sites we manage for clients where a compromised CMS is a compliance event.
Two reactions circulate whenever a WordPress security advisory drops. One is the shrug: auto-updates are on, someone else will handle it. The other is the alarm: pull everything offline, call the lawyers. Neither is the right call here. The right call is reading a version number today, before anything else.
On September 22, 2026, WordPress released version 7.1.2, patching CVE-2026-87902 — a CVSS 9.2 path traversal in page-template resolution that can lead to remote code execution on certain server configurations. The vulnerability is unauthenticated: no login, no credentials, no inside knowledge of the site required. Every WordPress version from 4.7 through 7.1.1 is affected. The release came five days after 7.1.1 shipped.
For sites not yet on the 7.x branch, the fix was simultaneously backported to 7.0.6, 6.9.9, and 6.8.10. The vulnerability was reported by Robert Ressl; technical details were published by Patchstack. WordPress.org published the release notes at wordpress.org/news/2026/09/wordpress-7-1-2-release/.
The client list puts this in sharp focus for us. We manage WordPress installs for PBS, Penn State, Amgen, and health systems. For institutions like those, a publicly reachable exploit on their CMS is not a defacement story — it is a breach-notification event with disclosure obligations, regulatory exposure, and institutional reputation on the line. The unauthenticated vector means any internet-facing site on an unpatched version is exposed right now, before an attacker knows anything about it.
An unauthenticated RCE on a health system’s CMS is not a website problem. It is a compliance event that starts a clock.
Our immediate work: verify every managed site is running 7.1.2 or its relevant backport, confirm that auto-updates actually fired rather than assuming they did, and send a plain one-line heads-up to clients who self-manage. Not a scare note — a version check with a link. That kind of proactive contact, on a Tuesday before most IT teams have read their advisories, is exactly what a long-term retainer should feel like from the client side.
The patch is out, the fix is straightforward, and there is no reason to be behind on this one by the end of the day.