The WordPress hole we wrote yesterday is already being used

Yesterday we said CVE-2026-87902 had no public use and that last Thursday's 7.1.1 was still open. The first attempts landed the same afternoon the patch shipped. Patchstack says the probes have moved on to writing PHP files. Previdian counted 68 tries against its honeypots starting September 23, with the earliest stamp at 11:49 UTC on the 22nd. The Hacker News carried it this morning. 7.1.2 is no longer a courtesy. It is the close.

What changed overnight

The bug is still the same: no account, a site can be made to load a PHP file outside the theme folders, and on some servers that becomes code as the web user. WordPress scored it 9.2. We are not going to recap the preconditions or the public test. The useful sentence today is that people are trying it, and some of those tries write files.

Previdian's Ryan Dewhurst said auto-updates mean you will see a lot of noise and fewer real hits. That is comfort only if the site actually took 7.1.2. A host that stopped at 7.1.1 on September 17 is still in the blast. Same table as yesterday: 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, courtesy builds back to 4.7.37.

Why a small Canadian shop should look twice

Most Alberta brochure sites, membership pages, and yard-company blogs sit on WordPress. Someone clicked Update last week, saw a green 7.1.1, and closed the ticket. That ticket reopened yesterday and it is now an incident question: did 7.1.2 land, and is there a PHP file in tmp or in the web root that nobody put there. cPanel CalDAV-to-root is still this week's other hosting job. Toolkit 6.11.3 does not replace the WordPress number.

What we would do this morning

• Dashboard, Updates. You want 7.1.2 if you are on 7.1. Look at the version on the site, not the host's auto-update sentence.
• If the site was on 7.1.1 (or older) after Tuesday afternoon, treat it as possibly probed. Look for PHP you did not write, especially in temporary directories and odd names in the web root. A file you cannot explain is a ticket, not a curiosity.
• Do not paste a public proof onto a live site to "see if you were vulnerable." The version number is the test.
• Zyxel GS1900 is due today. F5 APM is due tomorrow. Do not let the blog CMS bury the switch.

Bottom line

A security release that is two days old and already used is how a quiet site becomes a foothold. Forensic Five will ask which WordPress number you are on and whether anyone looked for files after Tuesday. From St. Albert, Alberta. Take 7.1.2. Then go look at the mail server and the build box, because those two also moved overnight.