WordPress Issues Emergency Patch for Critical RCE Vulnerability as Attackers Strike Within Hours of Disclosure

Mahapatra pointed out that this caution often creates a paradox where the most "mature" organizations are the most vulnerable. While a hobbyist blogger likely has default auto-updates enabled and was patched within minutes, large corporations often disable these features to enforce strict change control.

"Enterprise sites routinely disable auto-updates to maintain governance," Mahapatra explained. "This means the organizations with the most sophisticated processes are the ones most likely to still be exposed, because their own internal bureaucracy is holding the fix in a queue while attackers are already scanning their networks. A change control process that cannot distinguish between an unauthenticated RCE flaw and a routine plugin update is protecting the process rather than the enterprise. This vulnerability makes that lack of distinction very expensive."

Nidhi Luthra, an executive advisor for Acceligence, added that the "attacker roadmap" created by a patch release necessitates a paradigm shift. "Emergency patching for internet-facing systems needs an hours-level response," she said. "The luxury of a week-long testing cycle is gone."

Forgotten WordPress sites may not be patched

Perhaps the most significant hurdle for large organizations is the sheer scale of their "invisible" attack surface. Mahapatra noted that many enterprise WordPress deployments occur "below the radar." These sites are not necessarily "shadow IT" in the sense that they were built in secret; rather, they are authorized projects that have simply been forgotten by IT management over time.

"The exposure is materially larger than most organizations assume because most enterprises do not think of themselves as ‘WordPress shops,’ yet almost all of them are," Mahapatra said. "The risk sits in the web estate that IT never inventoried: marketing microsites, temporary campaign landing pages, regional country-specific sites, and investor relations pages often built by outside agencies. Furthermore, the properties of companies acquired years ago that were never fully migrated into the core infrastructure are major risks."

Because the affected version range for CVE-2026-87902 extends back to version 4.7.0, it covers nearly a decade of WordPress installations. These forgotten sites are exactly the ones most likely to be running on old, unpatched branches of the software.

This issue is particularly prevalent in the financial sector. "When I walk through external attack surface reviews with banking CISOs, the WordPress instances that surface are almost never the primary corporate site," Mahapatra observed. "They are sites belonging to a subsidiary, a marketing initiative, or an agency contract that expired years ago. None of them appear in the Configuration Management Database (CMDB) that the security team uses for patching. These abandoned sites become the perfect entry point for an attacker to gain a foothold in the corporate network."

As attackers continue to refine their payloads and scanning tools, the window for action is closing. Security experts agree that the only defense against this new generation of rapid exploitation is a combination of total asset visibility, accelerated testing cycles, and a willingness to prioritize critical security patches over standard administrative procedures.