WordPress Sites Hacked in Hours—Is Your Site Next?

Emily Davis · 2026-09-24

Imagine waking up to find your WordPress site has been taken over by someone you've never met. That's exactly what's happening right now to thousands of site owners. Threat actors have started actively exploiting a critical security flaw in WordPress within hours of it becoming public. And it's not just a minor bug—it's a serious one that could put your entire site at risk. ### What Exactly Is CVE-2026-87902? The vulnerability is tracked as CVE-2026-87902, and it carries a CVSS score of 9.2. If you're not familiar with CVSS, just know that anything above 9.0 is considered critical. This isn't something you can ignore and hope it goes away. Here's the scary part: an unauthenticated attacker—meaning someone who doesn't even need a login—can exploit this flaw to achieve remote code execution (RCE). In plain English, that means they can run their own code on your server. They could steal data, install malware, or turn your site into a launchpad for other attacks. ### How Does the Attack Work? According to security researchers, the flaw lives in the `get_page_template()` function. An attacker can manipulate the page-template resolution to include a chosen readable local .php file. Think of it like someone tricking your site into opening a backdoor that should have been locked. Once that happens, they can execute arbitrary PHP code, which gives them almost complete control. > "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file." That quote comes straight from the vulnerability disclosure, and it sums up why this is so dangerous. No username, no password—just a crafted request and they're in. ### Why Speed Matters More Than Ever Attackers are moving faster than ever. Within hours of the disclosure, they were already scanning for vulnerable sites. If you haven't updated WordPress or applied a patch, you're essentially leaving your front door wide open. The longer you wait, the higher the chance you'll become a statistic. ### What You Should Do Right Now - **Update WordPress immediately.** If a patch is available, apply it. Don't wait for tomorrow. - **Check for signs of compromise.** Look for unusual files, unexpected admin users, or strange traffic patterns. - **Use a web application firewall (WAF).** A good WAF can block many exploitation attempts before they reach your site. - **Consider a security plugin.** Tools like Wordfence or Sucuri can add an extra layer of protection. - **Stay informed.** Follow security news so you're not caught off guard next time. ### The Bigger Picture This isn't just about one vulnerability. It's a reminder that the web is constantly under attack. WordPress powers over 40% of all websites, which makes it a prime target. Every site owner—from bloggers to small business owners—needs to take security seriously. So, take a deep breath, but don't relax just yet. Check your site, update everything, and make sure you're not the next victim. Your website is your digital home. Protect it like you would your physical one.