WordPress sites are exposed through three layers: core, the plugins and themes on top, and the PHP runtime underneath. Each has had a serious issue in the last six weeks. This page lists what matters at our check on 24 October 2026 and points you to the article that fits your situation.
What matters right now
- WordPress core CVE-2026-87902 is a critical flaw fixed in 7.1.2 on 22 September and backported to 4.7. CISA added it to the Known Exploited Vulnerabilities catalog on 25 September, per the WordPress 7.1.2 announcement and the CISA KEV entry.
- PHP2Shell sits in PHP itself, so updating WordPress does not fix it. The fixed builds were announced in the PHP security notice of 21 October.
- Elementor Pro CVE-2026-32475 is an unauthenticated file upload flaw in versions up to 4.2.1, fixed in 4.2.2, per its CVE.org record.
- UpdraftCentral connection keys were compromised in October. The vendor's incident notice points to UpdraftPlus 1.26.13 and removing connection keys.
- Rank Math PRO 3.0.123 shipped with malicious code. The vendor's incident page gives the affected build and the cleanup order.
Where to start
- If you want the core story first, start with the core RCE and what 7.1.2 fixed, then read the seven fixes in 7.1.3, ranked.
- If your host runs PHP for you, read whether PHP2Shell reaches a WordPress site, then hardening steps in order after a PHP incident.
- If you build with Elementor, start with the Elementor Pro upload flaw.
- If you use a backup or management plugin, read what to do after the UpdraftCentral key compromise and which plugins hold remote control keys.
- If you run Rank Math PRO, use the 3.0.123 malware check.
- If an admin account appeared that you did not create, see how to find a hidden WordPress admin.
- If visitors see a fake captcha, read removing the fake verify box.
- If you manage the site for others, who is responsible for patching settles whose job each layer is.
The free scan from Red by run.cloud reads the versions your site serves and matches them to known vulnerabilities. It can say a version is affected, and it cannot see a vendor backport or a restart, so your host or server confirms the rest.