On September 22, 2026, WordPress shipped version 7.1.2 to fix CVE-2026-87902, a critical flaw that lets an unauthenticated attacker include a chosen local PHP file during page-template resolution and, under certain conditions, execute code. Update immediately, especially sites without automatic updates.
In late August 2026 Cloudflare released EmDash, a TypeScript CMS pitched as the spiritual successor to WordPress, and moved its own blog onto it. The core idea is one mechanism: isolating every plugin in a sandbox with declared permissions, where 96% of WordPress flaws come from plugins.
On 27 August 2026, GiveWP fixed CVE-2026-82222, a three-bug chain that turns a WordPress donation form into remote command execution with no real authentication. Administrators must upgrade to 4.16.7.2 and check for rogue accounts, even on sites where registration was disabled.
Two authentication flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, exploited since mid-August 2026, let an unauthenticated visitor become an administrator. The six paid editions never received a public advisory, so no vulnerability scanner could detect them.
A vulnerability chain in WordPress Core, dubbed XSS2Shell, lets an unauthenticated attacker turn a single failed login attempt into full PHP remote code execution. The 7.0.3 patch landed August 6, 2026 — 43% of the web needs to apply it now.
