CISA put WordPress CVE-2026-87902 on its Known Exploited Vulnerabilities catalog on 25 Sep 2026, with a federal due date of 28 Sep 2026. That is today for many of you reading this on Monday.
If your sites are not on WordPress 7.1.2 (or the fixed release for your branch), treat this as the morning update. Everything else in this WPNXT is short carry: Elementor free 4.3.2 for a CSRF fix, and a one-line note that Elementor MCP is out of beta. I am not turning this into three separate security posts.
What CISA just stamped
WordPress shipped 7.1.2 on 22 Sep as a security-only release. The bug is an unauthenticated path traversal / LFI in get_page_template() that can reach conditional remote code execution (CVSS 9.2 in the advisory coverage). It affects 4.7.0 through 7.1.1. It is fixed in 7.1.2, with backports on older eligible branches.
Within hours of the patch, attackers started probing. Patchstack, BleepingComputer, and The Hacker News all covered active scanning. Some writeups describe pearcmd-style writes under /tmp and /var/tmp, and PoC tooling in circulation.
Then CISA added the CVE to KEV on 25 Sep, due 28 Sep, with forensic triage expectations under BOD 26-04 for US federal agencies. Private shops are not bound by that BOD. The KEV stamp still matters. It is the clearest public signal that this is no longer “update when you have a quiet window.”
This is not last week’s Click2Shell / 7.1.1 story. Different release. Different entry model. Click2Shell needed a logged-in admin (or XSS) to force a theme install. CVE-2026-87902 does not need a login for the LFI path. Do not mix the two in your head when you check versions.
My take: “conditional RCE” is not a reason to wait. Staging sites, forgotten branch installs, and client fleets that only update on Fridays are exactly where this lands. Confirm the version string after the update. CDN and object cache can lie for a few minutes.
Do this for core:
- Update every managed site to WordPress 7.1.2 (or the matching fixed branch release). Confirm Dashboard → Updates (or
wp core version) shows the new number and that it stuck. - If any site was still unpatched after 22 Sep, review logs for odd
pagename/page_idpairs and check/tmpand/var/tmpfor unexpected.phpfiles. - Keep your firewall current. Patchstack RapidMitigate and Wordfence help. They are a seatbelt. They are not a substitute for the core update.
Primary reads: CISA Known Exploited Vulnerabilities Catalog · WordPress 7.1.2 release · GHSA-7hp8-65ch-5whp · Patchstack on probing · BleepingComputer
Quick carry: Elementor 4.3.2 (CSRF)
If you run free Elementor, make sure you are on 4.3.2 or newer (or still below 4.3.0). Versions 4.3.0 and 4.3.1 had a REST CSRF issue now tracked as CVE-2026-62062. A crafted link can make a logged-in user run REST actions their capabilities allow. Patchstack’s public walkthrough includes creating an admin as the demo impact. Whole REST surface, not one cute endpoint.
Action: bump Elementor to ≥ 4.3.2 in the same Updates pass as core. If a site sat on 4.3.0 or 4.3.1, skim for unexpected administrator users and odd recent REST activity. Mitigation plugins do not replace the plugin update.
This WPNXT is the announce. The “Depending on a hidden experiment is not allowed” critical-error wall is a separate Format A how-to (same 4.3.2 action, different reader problem). Do not mix them.
Source: Patchstack Elementor CSRF · Patchstack DB CVE-2026-62062
Quick carry: Elementor MCP is out of beta
Elementor’s MCP connection for Claude, Codex, Cursor, and similar tools left beta on 23 Sep. It drafts native Elementor / atomic structure as drafts you finish in the Editor. Admin-only. Per site. Soft action only: try on staging if you already use Atomic Editor. Human review before publish. Full setup walkthrough is a Format A piece, not this Monday news roundup.
Source: Elementor MCP launch
Do this week
- Confirm WordPress 7.1.2 (or branch fix) on every site you touch today. Version string, not “I clicked Update.”
- Bump Elementor to ≥ 4.3.2 if you are on 4.3.0 or 4.3.1.
- If a site was late to 7.1.2 after 22 Sep, do the log and
/tmp//var/tmppass before you close the ticket. - Fleet managers: batch core + Elementor in one window. Staging first when the stack is fragile. Same day when it is normal.
- MCP: optional staging try only. Not a production Monday experiment.
Soft close
That is the Monday: CISA stamped the 7.1.2 bug as known exploited, the federal clock hits today, and Elementor fleets should not still be on 4.3.0 or 4.3.1.
WPNXT lands Mondays in this same spot. If you want a second pair of eyes on whether a homepage and plugin stack are in a safe place after this week’s updates, you can reach out for a homepage review. No countdown. No score theater. Just a clear look at what is actually live.
Primary sources this week: CISA KEV · WordPress 7.1.2 · GHSA-7hp8-65ch-5whp · Patchstack CVE-2026-87902 probing · Patchstack Elementor CSRF · Elementor MCP launch