[{"data":1,"prerenderedAt":243},["ShallowReactive",2],{"seo-verification":3,"blog-wordpress-cve-2026-87902-update-to-712-now-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-wordpress-cve-2026-87902-update-to-712-now-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":35,"sections":36,"ctaTitle":165,"ctaBody":166,"ctaButton":167,"ctaUrl":168,"relatedPosts":169},373,"wordpress-cve-2026-87902-update-to-712-now",{"fr":12,"en":10,"ar":13,"es":14},"wordpress-cve-2026-87902-rce-mise-a-jour-7-1-2","ووردبريس-cve-2026-87902-ترقية-7-1-2","wordpress-cve-2026-87902-actualiza-a-712-urgente","WordPress CVE-2026-87902: Update to 7.1.2 Now","CVE-2026-87902 (CVSS 9.2) actively exploited since Sept. 22, 2026. Check your version, apply WordPress 7.1.2, and see why shared hosting extends exposure.",8,0,false,"2026-09-24T00:00:00+00:00","2026-09-24T12:27:51+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[28],{"id":17,"name":23,"slug":24,"color":25,"icon":26},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fwordpress-cve-2026-87902-rce-mise-a-jour-7-1-2-poster.svg",{"categorySlug":33,"appSlug":34},"cms-websites","wordpress","On September 22, 2026, the WordPress team released version 7.1.2 to fix CVE-2026-87902, an unauthenticated local file inclusion (LFI) vulnerability that can lead to remote code execution (RCE) under certain conditions. The CVSS 4.0 score is 9.2 out of 10. Less than five hours after the patch was published, Patchstack recorded the first malicious requests at 17:44 UTC. All WordPress installations from version 4.7.0 through 7.1.1 are affected — nearly a decade of releases. This article explains how to verify your exposure, apply the patch in under two minutes, and why shared hosting leaves you exposed longer than a VPS.",[37,40,43,45,54,56,58,73,75,77,79,89,91,93,111,113,115,142,144,147,149,151,159,161,163],{"type":38,"body":39},"h2","CVE-2026-87902 in Brief — What's Happening Right Now",{"type":41,"body":42},"p","The vulnerability lies in the `get_page_template()` function, which builds the theme filename from the HTTP `pagename` parameter without proper validation. An unauthenticated attacker can inject double-encoded directory traversal sequences to force WordPress to include any readable PHP file on the server, outside allowed theme directories.",{"type":41,"body":44},"The flaw is classified as conditional LFI-to-RCE: code execution is not guaranteed on every installation, but the required conditions are widespread. Patchstack observed in the first hours of exploitation payloads using `pearcmd.php` — present by default in official Docker images and cPanel environments with PHP \u003C 8.5 — to write executable PHP files in `\u002Ftmp` or `\u002Fvar\u002Ftmp`. The CVSS 4.0 score of 9.2 reflects the complete absence of required authentication and the potential impact on server confidentiality, integrity and availability.",{"type":46,"items":47},"ul",[48,49,50,51,52,53],"Include an arbitrary readable PHP file outside the active theme directory via path traversal in the `pagename` parameter","Use `pearcmd.php` (present on cPanel\u002FPHP \u003C 8.5 and official Docker images) to write an attacker-controlled PHP file to disk","Drop a webshell in `\u002Ftmp` or `\u002Fvar\u002Ftmp` under a generic name (`wp-pear-rce-flag.php`, `poc87902.php`)","Execute shell commands on the server without any WordPress account or user interaction","Pivot to other sites hosted on the same server if permissions allow","Exfiltrate database data, API keys or readable `.env` files",{"type":38,"body":55},"Check Whether Your Sites Are Exposed",{"type":41,"body":57},"The first step is to know the WordPress version of each installation. With WP-CLI, the command is straightforward and runs in seconds, even across a fleet of dozens of sites.",{"type":59,"steps":60},"steps",[61,63,65,67,69,71],{"body":62},"Check the current version and available updates: `wp core version; wp core check-update`",{"body":64},"List all WordPress installations on a cPanel server (if you manage multiple sites): `find \u002Fhome -name 'wp-config.php' -not -path '*\u002Fwp-content\u002F*' 2>\u002Fdev\u002Fnull`",{"body":66},"Check the version of each installation found: `wp --path=\u002Fhome\u002Fuser\u002Fpublic_html core version`",{"body":68},"Check whether the active theme contains a directory starting with `page-` (exploitation condition): `ls $(wp --path=\u002Fhome\u002Fuser\u002Fpublic_html eval 'echo get_stylesheet_directory();') | grep '^page-'`",{"body":70},"Check if `register_argc_argv` is enabled (second exploitation condition): `php -r 'echo ini_get(\"register_argc_argv\") ? \"EXPOSED\" : \"OK\";'`",{"body":72},"Search for exploitation traces in access logs (characteristic pattern): `grep -E 'pagename=.*\\.\\..*page_id=' \u002Fvar\u002Flog\u002Fnginx\u002Faccess.log; grep -E 'pagename=.*%2e%2e.*page_id=' \u002Fvar\u002Flog\u002Fapache2\u002Faccess.log`",{"type":41,"body":74},"An installation is exposed to RCE if it meets all three conditions: version between 4.7.0 and 7.1.1, active theme containing a `page-*` directory at root level, and `register_argc_argv` enabled. LFI alone (without RCE) is possible when the first two conditions are met. Most commonly cited themes include legacy default themes (Twenty Twelve, Twenty Fourteen) and popular third-party themes like Neve, Hestia and Sydney.",{"type":38,"body":76},"Back Up Before Patching",{"type":41,"body":78},"Before any WordPress core update, a backup is essential. On a VPS, the most reliable method is a VM snapshot — it captures the complete disk state in seconds and allows immediate rollback if there's a plugin compatibility issue. In parallel, exporting the database with WP-CLI provides targeted restoration without needing to roll back the full snapshot.",{"type":59,"steps":80},[81,83,85,87],{"body":82},"Create a VM snapshot from the VPS control panel (instant operation, rollback in under 2 minutes) — or via API if you automate: `# Example with Proxmox API; pvesh create \u002Fnodes\u002F{node}\u002Fqemu\u002F{vmid}\u002Fsnapshot --snapname pre-wp712`",{"body":84},"Export the WordPress database with WP-CLI: `wp db export backup-pre-712.sql --add-drop-table`",{"body":86},"Verify dump integrity: `wp db check`",{"body":88},"Copy the dump off the server (remote or local storage): `rsync -avz user@server:\u002Fhome\u002Fuser\u002Fpublic_html\u002Fbackup-pre-712.sql .\u002F`",{"type":38,"body":90},"Patching WordPress 7.1.2 — Step by Step",{"type":41,"body":92},"On a VPS with root access, the WordPress update is performed via WP-CLI without any hosting provider involvement. The complete process — backup included — takes less than three minutes. WordPress 7.1.2 was published on September 22, 2026; fixes have also been backported to all maintained branches back to version 4.7.",{"type":59,"steps":94},[95,97,99,101,103,105,107,109],{"body":96},"Put WordPress into maintenance mode to avoid requests during the update: `wp maintenance-mode activate`",{"body":98},"Update WordPress core to 7.1.2: `wp core update`",{"body":100},"Verify the update was applied successfully: `wp core version; # Should return: 7.1.2`",{"body":102},"Update the database if needed: `wp core update-db`",{"body":104},"Flush object cache and application caches: `wp cache flush`",{"body":106},"Disable maintenance mode: `wp maintenance-mode deactivate`",{"body":108},"Check for errors in logs and test a key page: `wp eval 'echo get_permalink(get_option(\"page_on_front\"));'; curl -sI https:\u002F\u002Fyour-site.com\u002F | grep HTTP`",{"body":110},"If multiple sites are hosted, loop over each installation: `for dir in $(find \u002Fhome -name 'wp-config.php' -not -path '*\u002Fwp-content\u002F*' -exec dirname {} \\;); do;   echo \"=== $dir ===\";   wp --path=\"$dir\" core update; done`",{"type":38,"body":112},"Why Shared Hosting Exposes You Longer",{"type":41,"body":114},"On shared hosting, WordPress core updates are managed by the provider or the control panel (cPanel, Plesk). The window between patch publication and effective application depends on the provider's schedule, server load and their own regression testing. In the case of CVE-2026-87902, active exploitation started less than five hours after the patch was released — well below the update cycle of most shared hosts.",{"type":116,"rows":117,"headers":138},"comparison",[118,122,126,130,134],[119,120,121],"Time to patch after publication","Shared hosting: 12 to 72 hours depending on provider","Root VPS: under 3 minutes with WP-CLI",[123,124,125],"Access to access logs","Shared hosting: limited or unavailable depending on plan","Root VPS: full access to \u002Fvar\u002Flog in real time",[127,128,129],"Control over `register_argc_argv`","Shared hosting: set by provider, often enabled","Root VPS: can be disabled via `php.ini` in 30 seconds",[131,132,133],"Site isolation","Shared hosting: same server as other customers","Root VPS: dedicated environment, no neighbors",[135,136,137],"Pre-patch backup","Shared hosting: snapshot unavailable or paid add-on","Root VPS: instant snapshot via API",[139,140,141],"Criterion","Shared (cPanel\u002FPlesk)","Root VPS ServOrbit",{"type":41,"body":143},"The argument \"my host updates automatically\" no longer holds against exploitation starting at J+0 in under five hours. For CVE-2026-87902, the first malicious requests were recorded on September 22, 2026 at 17:44 UTC — before most shared hosts had time to plan and test their deployment.",{"type":145,"body":146},"tip","Recommended post-patch configuration: (1) Disable XML-RPC if you're not using WordPress mobile apps or Jetpack:\n`\u002F\u002F In wp-config.php\nadd_filter('xmlrpc_enabled', '__return_false');`\n(2) Force automatic core updates for future security releases:\n`\u002F\u002F In wp-config.php\ndefine('WP_AUTO_UPDATE_CORE', 'minor');`\n(3) Disable `register_argc_argv` in `php.ini` to remove the RCE vector via `pearcmd.php`:\n`register_argc_argv = Off`\n(4) Add a WAF rule to block traversal patterns in the `pagename` parameter while the patch propagates to lagging installations.",{"type":38,"body":148},"Troubleshooting — Common Post-Patch Errors",{"type":41,"body":150},"WordPress core updates are usually smooth, but certain environments have predictable issues. Here are the most common cases and their resolution.",{"type":46,"items":152},[153,154,155,156,157,158],"**Database connection error after update**: run `wp core update-db` if you haven't — some schema migrations don't apply automatically.","**White screen or 500 error**: check PHP logs (`\u002Fvar\u002Flog\u002Fphp8.x-fpm.log`) and temporarily deactivate all plugins to isolate a compatibility conflict with version 7.1.2: `wp plugin deactivate --all`.","**Permission denied on `wp-content\u002F`**: WP-CLI must be run as the file owner. On cPanel: `su - cpanelusername -c 'wp core update'`.","**Update impossible, \"Filesystem not available\" message**: configure direct access method in `wp-config.php`: `define('FS_METHOD', 'direct');` — valid only on a VPS where you own the files.","**Child theme breaking after patch**: if your child theme inherits from a theme with a `page-*` directory, check parent theme compatibility with 7.1.2 on the theme's GitHub repository or WordPress.org page.","**Stale object cache (Redis\u002FMemcached)**: after `wp cache flush`, restart the cache service if errors persist: `systemctl restart redis` or `systemctl restart memcached`.",{"type":38,"body":160},"From WordPress to a More Robust Architecture",{"type":41,"body":162},"CVE-2026-87902 illustrates a structural reality: WordPress core is a large attack surface, and each critical flaw raises the question of execution environment control. A dedicated VPS doesn't eliminate vulnerabilities, but it reduces the exposure window to minutes, allows auditing the environment (logs, PHP config, process isolation) and precise response to each documented attack vector.",{"type":41,"body":164},"For agencies and developers managing a fleet of WordPress sites, consolidating on a VPS with WP-CLI installed and automated update scripts transforms a security emergency into a routine procedure. The operational cost of a VPS is offset by eliminating the provider delay — which, as this CVE shows, can be decisive.","Patch in Minutes, Not Hours","On a ServOrbit VPS, `wp core update` runs with direct root access — no waiting for your host to apply the patch. CVE-2026-87902 was exploited in under five hours after the fix was published. The difference between exposed and protected comes down to access to your own server.","Get a Secure VPS","\u002Fvps-cloud",[170,187,206,227],{"id":171,"slug":172,"slugs":173,"title":177,"excerpt":178,"readTime":179,"views":180,"isPinned":19,"publishedAt":181,"updatedAt":182,"category":183,"categories":184,"featuredImage":29,"bgImage":30,"posterImage":186,"relatedSolution":29},339,"postgresql-cve-2026-6471-patch-self-hosted-instances",{"fr":174,"en":172,"ar":175,"es":176},"postgresql-cve-2026-6471-patch-instances-self-hosted","تصحيح-ثغرة-postgresql-cve-2026-6471-الخوادم-الذاتية","cve-2026-6471-postgresql-parchear-instancias-self-hosted","Patching PostgreSQL (CVE-2026-6471, -14669) on VPS","Two critical PostgreSQL flaws fixed on August 13, 2026: replication access to RCE and heap overflow to RCE. How to patch your self-hosted instances via apt and Docker.",7,1,"2026-09-08T00:00:00+00:00","2026-09-08T21:59:59+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},[185],{"id":17,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fpostgresql-cve-2026-6471-patch-instances-self-hosted-poster.svg",{"id":188,"slug":189,"slugs":190,"title":194,"excerpt":195,"readTime":196,"views":18,"isPinned":19,"publishedAt":197,"updatedAt":198,"category":199,"categories":200,"featuredImage":29,"bgImage":30,"posterImage":202,"relatedSolution":203},360,"n8n-cve-2026-21877-critical-rce-patch",{"fr":191,"en":189,"ar":192,"es":193},"n8n-cve-2026-21877-mise-a-jour-urgence","n8n-cve-2026-21877-تصحيح-ثغرة-rce","n8n-cve-2026-21877-parche-rce-critico","n8n CVE-2026-21877: patch critical RCE CVSS 9.9 now","CVE-2026-21877 enables authenticated remote code execution in n8n (CVSS 9.9). Update to ≥ 1.121.3 and apply the scheduling workaround.",10,"2026-09-18T00:00:00+00:00","2026-09-19T02:00:43+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},[201],{"id":17,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fn8n-cve-2026-21877-mise-a-jour-urgence-poster.svg",{"categorySlug":204,"appSlug":205},"automation-workflows","n8n",{"id":207,"slug":208,"slugs":209,"title":213,"excerpt":214,"readTime":215,"views":18,"isPinned":19,"publishedAt":216,"updatedAt":217,"category":218,"categories":223,"featuredImage":29,"bgImage":30,"posterImage":225,"relatedSolution":226},73,"host-wordpress-on-your-own-vps",{"fr":210,"en":208,"ar":211,"es":212},"heberger-wordpress","استضافة-wordpress-على-خادم-vps-الخاص-بك","alojar-wordpress-en-un-vps","Host WordPress on your own VPS","Host WordPress on your VPS for maximum performance and control: Docker, MariaDB, caching, reverse proxy and SSL.",3,"2026-04-08T00:00:00+00:00","2026-09-08T22:00:02+00:00",{"id":179,"name":219,"slug":220,"color":221,"icon":222},"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[224],{"id":179,"name":219,"slug":220,"color":221,"icon":222},"\u002Fblog\u002Fcovers\u002Fheberger-wordpress-poster.svg",{"categorySlug":220,"appSlug":34},{"id":228,"slug":229,"slugs":230,"title":234,"excerpt":235,"readTime":196,"views":18,"isPinned":19,"publishedAt":236,"updatedAt":237,"category":238,"categories":239,"featuredImage":29,"bgImage":30,"posterImage":241,"relatedSolution":242},368,"wordpress-multisite-vps-manage-n-client-sites-one-install",{"fr":231,"en":229,"ar":232,"es":233},"wordpress-multisite-vps-agence","ووردبريس-متعدد-المواقع-على-vps-ادارة-مواقع-العملاء","wordpress-multisite-vps-gestiona-n-sitios-en-una-instalacion","WordPress Multisite on a VPS: run N client sites from one install","Enable WordPress Multisite on a dedicated VPS to centralize N client sites under one codebase, one update cycle, and isolated subdomains. Full guide for agencies.","2026-09-20T00:00:00+00:00","2026-09-20T21:13:51+00:00",{"id":179,"name":219,"slug":220,"color":221,"icon":222},[240],{"id":179,"name":219,"slug":220,"color":221,"icon":222},"\u002Fblog\u002Fcovers\u002Fwordpress-multisite-vps-agence-poster.svg",{"categorySlug":33,"appSlug":34},1790253237088]