Hackers are targeting a critical WordPress flaw, so be on your guard

A Serious WordPress Flaw Is Being Exploited Right Now

If you run a website on WordPress, and a surprising number of local businesses, churches, nonprofits, and hobbyists around Washington Crossing and Newtown do, this is one security story you shouldn’t skim past. Researchers have confirmed that attackers are actively exploiting a high-severity vulnerability in WordPress Core, the base software that every WordPress site runs on, regardless of theme or plugins.

The flaw is tracked as CVE-2026-87902 and carries a severity score of 8.1 out of 10. It was discovered by security researcher Robert Ressl. Technically it’s a path traversal bug, and it’s unauthenticated, meaning an attacker doesn’t need a username, password, or any account on your site to try it.

Here’s a plain-English version of what that means. Websites are supposed to keep visitors confined to certain folders on the server. A path traversal flaw lets an attacker craft a request that climbs out of those folders and reaches files it was never meant to touch. In this case, that can lead to PHP file inclusion, where the server is tricked into loading and running a PHP file the attacker points it to. From there, the worst case is remote code execution: the attacker runs their own commands on your web server and effectively owns the site.

What makes this especially urgent is the timeline. According to researchers, exploitation began within hours of the fix being released, and it is now described as widespread. That’s a familiar pattern: once a patch is public, attackers compare the old and new code, figure out what was fixed, and start scanning the internet for sites that haven’t updated yet.

The good news is that a fix exists. WordPress released version 7.1.2, and the security fix has been backported to older branches going back to 4.7. So even if your site is running an older major version, there should be a patched release available for your branch. The bad news is that none of that helps you until the update is actually installed on your site.

Why This Matters for Bucks County Websites

It’s easy to assume hackers only go after big companies. In reality, attacks like this are almost entirely automated. Bots sweep through millions of websites looking for vulnerable WordPress installs, and they don’t care whether you’re a national retailer or a bed-and-breakfast near the Delaware River. A small site with a forgotten update is often the easiest target of all.

Think about the kinds of WordPress sites we see across our area:

• Small businesses in Newtown Borough and along the Route 413 and 332 corridors, such as restaurants, salons, contractors, and boutiques, that had a site built a few years ago and rarely log in.
• Professional offices like accountants, attorneys, insurance agents, and real estate agents, whose sites often have contact forms collecting client names, emails, and phone numbers.
• Nonprofits, historical groups, and event organizers connected to Washington Crossing’s history and seasonal events, which frequently rely on volunteers to maintain the site.
• Churches, youth sports leagues, and parent groups in Council Rock and surrounding districts, where the site was set up once and then handed down from person to person.

A takeover isn’t just embarrassing. Compromised sites are commonly used to redirect visitors to scam pages, inject spam links that hurt your search rankings, host phishing pages, or push fake software updates that install malware on visitors’ Windows PCs. That last one matters for your reputation: if a neighbor visits your site and ends up with an infected laptop, they’ll remember where it happened.

There’s also the practical cost. Search engines and browsers may flag a hacked site with a warning screen, which can wipe out incoming customers overnight. Your hosting company might suspend the account. And cleaning up a compromised site, restoring from backups, and hunting down hidden backdoors takes far more time and money than applying an update in the first place.

If you’re not sure whether your organization even uses WordPress, that’s worth finding out today. Ask whoever built the site, or check with your hosting provider.

How to Check and Update Your Site from Your PC

For most site owners, patching this flaw takes a few minutes from any Windows PC with a web browser. Here’s a straightforward approach:

1. Make a backup first. Many hosting providers offer one-click backups in their control panel, and many sites have a backup plugin installed. Save a copy of both your files and your database. If an update ever causes a problem, you’ll be glad you did.
2. Log in to your WordPress dashboard. This is usually your web address followed by /wp-admin. If nobody remembers the login, that’s a sign the site hasn’t been maintained, and it’s worth sorting out access right away.
3. Go to Dashboard, then Updates. WordPress will show your current version and whether a newer one is available. You want 7.1.2 if you’re on the current branch, or the latest security release for your older branch if you’re running something from the 4.7-and-newer range.
4. Run the core update. While you’re there, update your plugins and theme as well. Old plugins are a common entry point for attackers, and there’s no sense leaving one door open after locking another.
5. Check the site afterward. Open your homepage, contact forms, and any shopping cart or booking pages to confirm everything still works.

A few notes from experience. Many WordPress sites have automatic minor updates turned on, and security releases like this one often install themselves. Don’t assume that happened, though. Confirm the version number yourself. Some hosts or site builders disable automatic updates to avoid breaking custom code, and some older sites simply stopped updating years ago.

If you use managed WordPress hosting, your provider may have already applied the patch. It’s still worth a quick email or support ticket asking them to confirm your site is on a fixed version.

Finally, if your site is running a very old version of WordPress, older than the 4.7 branch, there may not be a fix available at all. In that case, it’s time for a serious conversation about rebuilding or migrating, because an unpatchable site on the open internet is a liability.

If You Can't Update Immediately: Temporary Protections

Sometimes an update can’t happen right away. Maybe the site was heavily customized by a developer who’s no longer around, or you’re worried an update will break an online ordering system during a busy weekend. Researchers have pointed to some interim mitigations, but understand clearly: these are stopgaps, not substitutes for installing the patch.

Block path traversal sequences. Path traversal attacks typically rely on sequences like ../ (and encoded variations of it) in web requests to climb out of the intended folder. A web application firewall, whether provided by your host, a security plugin, or a service that sits in front of your site, can be configured to block requests containing these patterns. Many hosting companies have already added rules for this specific vulnerability, so ask yours.

Tighten risky PHP settings. Because this flaw leads to PHP file inclusion, locking down PHP behavior on your server reduces what an attacker can do. Settings such as allow_url_include should be turned off, and it’s worth reviewing other options that let PHP load files from unexpected locations. On shared hosting, these are often controlled through the hosting control panel or by the provider directly. If terms like these are unfamiliar, don’t guess. Ask your host or a qualified technician to review them, since changing server settings incorrectly can take a site offline.

Limit exposure while you plan. If the site is not essential for a few days, putting it into maintenance mode or temporarily restricting access is a reasonable choice. A brief outage is far better than a full compromise.

Watch your logs. Your hosting control panel likely provides access logs. Unusual requests with long strings of dots and slashes, or repeated hits to odd file paths, are a sign someone is probing your site.

The key point is timing. With exploitation described as widespread, every day an unpatched site stays online increases the odds it gets hit. Use these measures to buy a little time, then get the real fix installed.

Signs of Trouble and Protecting Your PC Too

Because attacks started so quickly, some sites may have been compromised before their owners ever heard about this flaw. Updating closes the hole, but it doesn’t remove anything an attacker already planted. After patching, take a few minutes to look for warning signs:

• Unknown administrator accounts under Users in your dashboard. Attackers often create a hidden admin so they can return later.
• Unexpected redirects, especially when visiting from a phone or from a search result instead of typing your address directly.
• Strange files in your site folders, particularly PHP files with random names or files in upload directories where only images should live.
• Spam pages or links appearing in search results for your site that you didn’t create.
• Warnings from your host, browser, or search engine about malicious content.

If you spot any of these, treat it as a real incident. Restoring from a clean backup made before the attack, followed by patching, is usually the safest route. Simply deleting the obvious bad file often leaves backdoors behind.

Don’t forget the PC side of the equation. Most people manage their websites from the same Windows computer they use for email, banking, and everything else. After any suspected compromise, change your WordPress, hosting, and FTP passwords, and do it from a computer you trust. Turn on two-factor authentication for WordPress and your hosting account if you haven’t already. Run a full scan with Windows Security or your antivirus to make sure no password-stealing malware is lurking, because stolen credentials are one of the most common ways sites get re-infected after cleanup.

It’s also a good moment to review who has access. Former employees, past volunteers, and old web designers often still have working logins years later. Remove anyone who no longer needs them.

The bigger lesson is that a website isn’t a set-it-and-forget-it project. A quick monthly check of updates, users, and backups goes a long way toward keeping your little corner of the internet, and the neighbors who visit it, safe.

Source

Based on reporting from TechRadar.

Contact G2 Computers in Washington Crossing

Need help? Contact G2 Computers today.