Webpronews2026-09-26 23:32:15

Critical Contact Form 7 Vulnerability CVE-2026-87902 Actively Exploited in WordPress 6.6

WordPress sites face active exploitation of critical CVE-2026-87902 in Contact Form 7 (v5.9.2–5.9.5) on WordPress 6.6.x, enabling unauthenticated attackers to upload PHP backdoors via directory traversal and gain full control.

Summary

Immediate patching to plugin 5.9.6+ and core 6.6.2 is essential.

wordpress security updcybersecurityupdatecontact form 7 vulnerabilitywordpress plugin exploitactive exploitation cve-2026-87902top newswordpress cve-2026-87902

This is a brief wire summary — the full story (linked below) has the complete details.

KazaSec's take

Incidents like this rarely start with the headline event itself — they usually trace back to an exposed remote-access endpoint, an unpatched perimeter system, or a credential phished weeks earlier. The organizations that recover fastest are the ones that tested their defenses and their incident response plan before they needed them.

Coverage details

Source: Webpronews
Published: 2026-09-26 23:32:15
Author: emma rogers
Category: toptechnology

We've archived 62 other articles touching the same topic (wordpress security upd, cybersecurityupdate, contact form 7 vulnerability) — see the full security news archive.

Worried this kind of story could be about you next?

We help organizations find and fix the gaps before they make headlines.

Request a Security Assessment Browse Services