WordPress Security, September 2026 in Review

This is the first of a monthly round-up. One post, at the end of each month, listing what actually changed in WordPress security and what, if anything, you need to do. It will not cover every CVE. Wordfence publishes a weekly list that runs to two or three hundred entries, and nobody reads it. This covers the handful that would change what a careful site owner does.

Core: two security releases in six days

On 1 September the core security team announced a three-part plan: faster security releases, clearing the backlog of open reports, and proactive scanning of core with AI tooling. September then delivered on the first part faster than anyone expected.

7.1.1 on 17 September fixed eleven security issues. The ones worth knowing about: an unauthenticated stored cross-site scripting bug in paragraph formatting, which means the comment form; a crafted URL that could install and preview a theme from WordPress.org; an authenticated path traversal in the REST API templates controller; an XML-RPC path that let changeset posts bypass the custom CSS capability check; and any logged-in user being able to re-parent comments. Three of the eleven were reported by Anthropic, which is the AI scanning part of the plan already producing results. Backports went out for 7.0.5, 6.9.8 and 6.8.9 the same day.

7.1.2 on 22 September fixed one bug, CVE-2026-87902, rated 9.2. A crafted pagename parameter could make get_page_template() include a PHP file from outside the active theme, and on servers with PEAR installed and register_argc_argv switched on, that became remote code execution. It affected every version from 4.7.0 and was backported all the way down to 4.7.37. Patchstack saw the first probes four hours after the release and the first file writes that afternoon.

If you have minor auto updates on, both landed on your sites without you doing anything, which is the whole argument for leaving them on. If you have them off, you had a window of hours on 22 September, and the chapter on core hardening explains why that is not a window anyone wins by hand.

Plugins: the patch from February is still being exploited

Elementor Pro's upload flaw from August kept being hit through September, and I wrote about the server rule that makes it a dead file earlier in the month. The newer story is WooCommerce Wholesale Lead Capture, CVE-2026-27540, an unauthenticated file upload through an exposed AJAX handler, rated 9.8. The vendor patched it in February, in version 2.0.3.2. Exploitation was reported on 16 September, and Wordfence said it had blocked more than a hundred thousand attempts since June.

Seven months after the fix. The 20i dataset gave the same answer last week from a different direction: most sites do not apply updates, premium or free, and a vulnerability stays useful to an attacker for as long as the unpatched sites outnumber the patched ones. The plugin census earlier this month showed how much of the top thousand is maintained by one person or not at all, which is the supply side of the same problem.

The 7.2 roadmap, and what it means for security

The roadmap for 7.2 went up on 18 September with a release pencilled in for early December. The security items committed for it are small and all worth having: an email notification when an Application Password is created, proper detection of whether the site is actually on HTTPS before allowing one, a safer default_role, and support for the SameSite cookie attribute on the auth cookies. Two larger items, a sudo mode that re-prompts for a password before sensitive admin actions and a Secrets API for storing credentials, are listed as stretch goals, so do not plan around them yet. AI features stay in the separate plugin.

The Application Password notification is the one I care about. Agents authenticate with them, and today a new one can be minted on your account without you ever hearing about it.

Server side

• PHP shipped security releases on 24 September across all four supported branches: 8.5.11, 8.4.26, 8.3.35 and 8.2.34. PHP 8.6 reached its second release candidate the same day and is due in November. PHP 8.2 drops out of security support at the end of this year.
• nginx fixed a buffer overflow in its HTTP/3 module on 15 September, in 1.30.5 and 1.31.6. It only matters if you have listen 443 quic in a server block, which most WordPress servers do not. The njs scripting module had its own fixes on 2 September, including an access control bypass in js_access.

What to do this month

• Confirm your sites are on 7.1.2 or the matching backport. wp core version on each one takes seconds.
• If minor auto updates are off anywhere, turn them back on and read the core hardening chapter for why.
• Run through your premium plugins and check their versions against the vendor's changelog, not the dashboard badge. Premium updates do not go through WordPress.org and some licence keys quietly lapse.
• Make sure PHP is on a patched build and that the FPM service was restarted after the update. A patched package with the old workers still running has not patched anything.

Where this fits

Chapter 2 of the Protect My WP handbook covers why core point releases are not optional, with the 7.0 and 7.1 releases as the worked examples. Chapter 8 covers the plugin update workflow that would have caught the WooCommerce case in February rather than September. Chapter 1 covers PHP support windows as fixed dates.

Get the book for £19.