Security Advisory: Critical WordPress Vulnerability - "Click2Shell"
Incident
Report for Liquid Web - Services
Subscribe to Updates
Identified
Our Engineering team continues to assess and work on the WordPress security vulnerabilities across our hosting fleet.
A new critical vulnerability, CVE-2026-87902, has been disclosed. WordPress 7.1.2 includes the security fix for this vulnerability.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to update to WordPress version 7.1.2 immediately.
We will continue to monitor the situation closely and provide further updates as new information becomes available.
A new critical vulnerability, CVE-2026-87902, has been disclosed. WordPress 7.1.2 includes the security fix for this vulnerability.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to update to WordPress version 7.1.2 immediately.
We will continue to monitor the situation closely and provide further updates as new information becomes available.
Investigating
WordPress has identified a critical security vulnerability designated as "Click2Shell" affecting all WordPress versions prior to 7.1.1. This vulnerability can enable unauthenticated Remote Code Execution (RCE) when a logged-in administrator visits a specially crafted link.
Current Status & Hosting Actions
Our engineering team is currently assessing our entire hosting fleet and determining next steps.
There are currently no known workarounds for this vulnerability other than upgrading to the latest version of WordPress.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to review their environments immediately and update to WordPress version 7.1.1.
We will continue to monitor the situation closely and provide further updates as new information becomes available.
Current Status & Hosting Actions
Our engineering team is currently assessing our entire hosting fleet and determining next steps.
There are currently no known workarounds for this vulnerability other than upgrading to the latest version of WordPress.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to review their environments immediately and update to WordPress version 7.1.1.
We will continue to monitor the situation closely and provide further updates as new information becomes available.