An Tran SolutionsSeptember 23, 20265 min read
WordPress Patched a Hole That Sat Quiet for Nearly 10 Years. The Reassuring Line in the Alert Is the Real Worry
On September 22, 2026, WordPress released 7.1.2 to fix CVE-2026-87902. The alert circulating online gets almost everything right, except one line. Less than five hours after the patch, attackers had started building target lists.