01/10/2026
Cybersecurity Awareness Month starts today. If your business, school or organisation has a WordPress website, here is one thing to do this week.
On 22 September, WordPress released an urgent security update (version 7.1.2). It fixes a serious flaw that can let attackers take over some websites without logging in. Attackers started scanning for it within five hours.
What to do:
- Log in to your WordPress dashboard and check the version. You need 7.1.2, or the latest update for your version (for example 7.0.6, 6.9.9 or 6.8.10).
- If someone else manages your website, send them this post and ask them to confirm it has been updated.
- Keep automatic security updates switched on.
- After updating, open Users and check for any administrator accounts you don't recognise.
If nobody is looking after your website, finding out who should be is the first step.
Sources:
https://socprime.com/blog/cve-2026-87902-critical-wordpress-core-rce-flaw/
https://www.csoonline.com/article/4226330/wordpress-patches-a-critical-severity-security-vulnerability.html