Critical WordPress Vulnerability Is Being Actively Exploited: What Businesses Should Do Now
WordPress powers websites for businesses of every size. Across Antigua and Barbuda and the wider Caribbean, it is commonly used for company websites, online stores, booking platforms, blogs and customer portals.
That popularity also makes WordPress an attractive target for cybercriminals.
A critical WordPress vulnerability is now being actively exploited. Businesses that operate a WordPress website should confirm immediately that their website has been properly updated.
What Is the WordPress Vulnerability?
On September 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-87902 to its Known Exploited Vulnerabilities Catalog.
Adding a vulnerability to this catalog means CISA has reliable evidence that attackers are exploiting it in real-world attacks. This is no longer simply a theoretical security weakness.
Under certain conditions, an attacker who does not have a username or password may be able to make a vulnerable WordPress website load a readable PHP file from outside the active theme directories.
Depending on the website’s server configuration and active theme, this could lead to remote code execution. In simple terms, an attacker may be able to run malicious commands on the server hosting the website.
Which WordPress Websites Are Affected?
The vulnerability affects WordPress websites that have not installed the appropriate security update.
WordPress released version 7.1.2 on September 22, 2026, to address the vulnerability. The security fix was also backported to eligible older WordPress branches.
However, businesses should not assume that their websites updated automatically. Automatic updates can fail because of server settings, disabled update features, file-permission problems or conflicts involving themes and plugins.
Website owners should ask their developer or hosting provider to verify the installed WordPress version and confirm that the specific fix for CVE-2026-87902 has been applied.
Why This WordPress Hack Matters to Caribbean Businesses
For many small and mid-sized businesses, the website is more than an online brochure. It may handle reservations, sales, payments, customer enquiries and personal information.
A compromised WordPress website could potentially be used to:
Steal customer or administrator information.
Add malicious code or unauthorized advertisements.
Redirect visitors to fraudulent websites.
Modify online payment or checkout pages.
Distribute malware to customers.
Create hidden administrator accounts.
Damage the company’s reputation.
Take the website offline.
A compromised website can also expose hosting accounts, databases and other systems that share the same server.
No Caribbean-specific compromises associated with this vulnerability have been publicly confirmed. However, automated attacks frequently scan websites worldwide for vulnerable WordPress installations. A business does not have to be individually selected or deliberately targeted to become a victim.
What Should WordPress Website Owners Do?
Businesses should take the following steps immediately.
1. Update WordPress
Log in to the WordPress administration area and go to:
Dashboard → Updates
Install the latest available WordPress security release. Whenever possible, update to WordPress 7.1.2 or later.
Your developer should also verify that the update completed successfully and that the website is running the expected version.
2. Update Themes and Plugins
Although CVE-2026-87902 is a WordPress Core vulnerability, outdated themes and plugins can create additional ways for attackers to compromise a website.
Install available security updates and remove themes or plugins that are no longer used. Deactivating an unnecessary plugin is not always enough; remove it completely if it is not required. You should never keep unused plugins; it's added risk you can avoid via removal.
3. Review Administrator Accounts
Check the website’s user list for:
Administrators you do not recognize.
Recently created accounts.
Unexpected changes to existing accounts.
Users with more access than they need.
Remove unauthorized accounts and reduce unnecessary administrator privileges.
4. Look for Signs of Compromise
Updating WordPress prevents future exploitation of this vulnerability, but it does not remove malicious code that may already be present.
Ask your developer, hosting provider or cybersecurity team to review:
Recently modified PHP files.
Unexpected files inside theme and upload directories.
Changes to active themes or templates.
Unfamiliar scheduled tasks.
Unusual website or server activity.
Unexpected redirects or pop-ups.
Changes to payment or checkout pages.
Suspicious administrator logins.
Website and server logs should be preserved if there is any indication that the site may have been compromised.
5. Change Important Credentials
If suspicious activity is found, change the passwords for:
WordPress administrator accounts.
The website hosting account.
FTP or SFTP access.
The website database.
Related email accounts.
Multi-factor authentication should also be enabled wherever it is available. Changing passwords alone is not sufficient if malicious code remains on the server.
6. Restore From a Trusted Backup if Necessary
If the website has been compromised, it may need to be rebuilt or restored from a known-clean backup created before the attack occurred.
Before restoring a backup, make sure the underlying vulnerability has been corrected. Otherwise, the restored website could be compromised again.
Do Not Treat the Update as the Entire Solution
Installing the security update is essential, but businesses must also consider whether the website was attacked before the update was applied.
The safest response includes both patching the vulnerability and checking the website for evidence of compromise.
If your business depends on WordPress for bookings, sales, payments or customer communications, contact your website provider today and request written confirmation that:
The WordPress security update has been installed.
The installed version has been verified.
Administrator accounts and website files have been reviewed.
Current, tested backups are available.
Protecting Your Business Website
Small businesses often assume that cybercriminals will only target large organizations. In reality, attackers frequently use automated tools to locate vulnerable websites, regardless of the company’s size or location. In fact, smaller organizations are becoming more common targets because they are usually ill-equipped to deal with such attacks. They are low hanging fruit that can be easily picked.
That said, regular updates, vulnerability scanning, secure backups and periodic website security testing can significantly reduce this risk.
AntiguaRecon helps organizations identify website vulnerabilities before attackers can exploit them. Our services include web application penetration testing, external vulnerability assessments, security reviews and practical cybersecurity guidance and awareness training for Caribbean businesses.
If you are concerned that your WordPress website may be vulnerable or compromised, contact AntiguaRecon to discuss the appropriate next steps.
Contact us at any time if you have questions, or need immediate help securing your organization's future.
- - -
Want to learn more about this topic? Check out these other posts:
A dubai vps can be useful for businesses targeting users in the Gulf region. The main thing I'd compare is network quality, since physical location alone doesn't guarantee good performance.