{"id":10873,"date":"2026-09-30T13:45:12","date_gmt":"2026-09-30T17:45:12","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10873"},"modified":"2026-09-30T12:10:53","modified_gmt":"2026-09-30T16:10:53","slug":"wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/","title":{"rendered":"WordPress&#8217;s new patch fixed one bug and prevented a whole category"},"content":{"rendered":"<p dir=\"ltr\">Four hours. That&#8217;s roughly how long it took attackers to go from probing a freshly patched WordPress flaw to actually writing files onto compromised servers. <a href=\"https:\/\/wordpress.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">WordPress<\/a> shipped its second security release in five days on September 22, fixing an unauthenticated path traversal bug in how the platform resolves page templates, and exploitation started before the day was even over.<\/p>\n<p dir=\"ltr\">Patchstack recorded the first attack attempt at 11:49 UTC that same day. By 15:34 UTC, attackers were writing files to disk. A public scanning template was circulating within 24 hours, and <a href=\"https:\/\/www.cisa.gov\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CISA<\/a> added the flaw to its Known Exploited Vulnerabilities catalog on September 25, giving federal agencies until September 28 to patch.<\/p>\n<p dir=\"ltr\">The bug comes down to something deceptively simple: a missing validation check. When WordPress decides what to render, it builds template filenames from two inputs. One goes through the platform&#8217;s own traversal protection. The other never did. That oversight opened a door for unauthenticated requests to pull in any readable PHP file sitting outside the active theme.<\/p>\n<p dir=\"ltr\">On its own, that is a problem, but a contained one. Add two host-side conditions, a PHP setting called register_argc_argv and the presence of PEAR&#8217;s pearcmd.php, and it becomes remote code execution. Patchstack found that combination showing up far more often than anyone would like. The PHP setting turns on by default in official PHP Docker images and in <a href=\"https:\/\/hostingdiscussion.com\/news\/hackers-have-been-quietly-exploiting-this-cpanel-flaw-since-february-and-millions-of-sites-are-at-risk\/\">cPanel environments<\/a> running PHP below version 8.5, which puts a lot of real-world servers in range.<\/p>\n<p dir=\"ltr\">CrowdSec&#8217;s telemetry shows the exploit spreading fast. Distinct attacking sources jumped from 237 on the first day to over 23,000 by September 27, while requests per source actually dropped, a pattern researchers associate with an exploit moving from a handful of skilled operators into automated, commodity scanning tools anyone can point at a target list.<\/p>\n<p dir=\"ltr\"><a href=\"https:\/\/hostingdiscussion.com\/news\/wordpress-patches-critical-flaw-found-by-ai\/\">WordPress<\/a> didn&#8217;t just patch the one bug, either. Alongside the specific fix, the security team added a broader check requiring every resolved template path to stay inside approved directories, treating template resolution as a category of risk rather than a single isolated flaw.<\/p>\n<p dir=\"ltr\">For site owners who cannot update right away, two quick checks are worth running: whether the active theme has a directory starting with &#8220;page-,&#8221; and whether register_argc_argv is currently on. Pulling out PEAR where it serves no purpose closes the known path to code execution without touching a single WordPress installation in the process.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Four hours. That&#8217;s roughly how long it took attackers to go from probing a freshly patched WordPress flaw to actually writing files onto compromised servers. WordPress shipped its second security release in five days on September 22, fixing an unauthenticated path traversal bug in how the platform resolves page templates, and exploitation started before the [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[8260,5367,7613,12,8261],"class_list":["post-10873","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2026-87902","tag-remote-code-execution","tag-security-patch","tag-wordpress","tag-wordpress-exploit"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>WordPress&#039;s new patch fixed one bug and prevented a whole category - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WordPress&#039;s new patch fixed one bug and prevented a whole category - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Four hours. That&#8217;s roughly how long it took attackers to go from probing a freshly patched WordPress flaw to actually writing files onto compromised servers. WordPress shipped its second security release in five days on September 22, fixing an unauthenticated path traversal bug in how the platform resolves page templates, and exploitation started before the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-30T17:45:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-30T16:10:53+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/\",\"name\":\"WordPress's new patch fixed one bug and prevented a whole category - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-09-30T17:45:12+00:00\",\"dateModified\":\"2026-09-30T16:10:53+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WordPress&#8217;s new patch fixed one bug and prevented a whole category\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WordPress's new patch fixed one bug and prevented a whole category - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/","og_locale":"en_US","og_type":"article","og_title":"WordPress's new patch fixed one bug and prevented a whole category - Web Hosting News","og_description":"Four hours. That&#8217;s roughly how long it took attackers to go from probing a freshly patched WordPress flaw to actually writing files onto compromised servers. WordPress shipped its second security release in five days on September 22, fixing an unauthenticated path traversal bug in how the platform resolves page templates, and exploitation started before the [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/","og_site_name":"Web Hosting News","article_published_time":"2026-09-30T17:45:12+00:00","article_modified_time":"2026-09-30T16:10:53+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/","url":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/","name":"WordPress's new patch fixed one bug and prevented a whole category - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-09-30T17:45:12+00:00","dateModified":"2026-09-30T16:10:53+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/wordpresss-new-patch-fixed-one-bug-and-prevented-a-whole-category\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"WordPress&#8217;s new patch fixed one bug and prevented a whole category"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":49,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10873"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10873\/revisions"}],"predecessor-version":[{"id":10874,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10873\/revisions\/10874"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}