Read-only check of the **WordPress core version of every site on a server**, with the fix table for
**CVE-2026-87902** (critical, unauthenticated; fixed in WordPress 7.1.2 on 2026-09-22 and backported to every branch down to 4.7).
For web agencies and admins who look after many WordPress sites: run it once over the whole hosting account and get one list.
bash check.sh ~/public_html # every WordPress under the folder
bash check.sh --log ~/logs/access_log ~/public_html # also an access log for attack requests (.gz OK)
bash check.sh --online ~/public_html # also ask api.wordpress.org: latest / outdated / insecure
- **Read-only.** It never runs PHP, WP-CLI or any code from the sites, and never prints `wp-config.php` secrets
(only the two automatic-update constants are checked).
- No network access unless `--online` (one request to `api.wordpress.org`, never to your sites).
- Works with bash 3.2+ (macOS) and Linux, including shared hosting with SSH. Needs `find`, `grep`, `sed`, `awk`.
| 1 | Core version against the CVE-2026-87902 fix for its branch (7.1.2, 7.0.6, 6.9.9 … 4.7.37) | CRITICAL if older than the fix |
| 2 | With `--online`: the version's status on wordpress.org | CRITICAL if `insecure`, REVIEW if `outdated` |
| 3 | `WP_AUTO_UPDATE_CORE false` / `AUTOMATIC_UPDATER_DISABLED` in `wp-config.php` | REVIEW (security releases won't install themselves) |
| 4 | A theme with a top-level `page-*` directory (a published precondition of the exploit) | REVIEW |
| 5 | PHP files inside `wp-content/uploads` | REVIEW |
| 6 | Published indicator files in `/tmp` and `/var/tmp` (`poc87902.php`, `wp-pear-rce-flag.php`, `luci_*.php`, `zeta_*.php`, marker `CVE-2026-87902-POC-OK`) | CRITICAL |
| 7 | With `--log`: `pagename` with `../` or `%2e%2e`, `pagename=templates%2f`, `pearcmd`, `config-create`, scanner user agents | CRITICAL if answered with 200, REVIEW if not |
Fixed versions (from GHSA-7hp8-65ch-5whp, checked against `api.wordpress.org/core/stable-check` on 2026-09-26):
| Branch | Fixed in | Branch | Fixed in | Branch | Fixed in |
| 7.1 | 7.1.2 | 6.3 | 6.3.12 | 5.4 | 5.4.23 |
| 7.0 | 7.0.6 | 6.2 | 6.2.13 | 5.3 | 5.3.25 |
| 6.9 | 6.9.9 | 6.1 | 6.1.14 | 5.2 | 5.2.28 |
| 6.8 | 6.8.10 | 6.0 | 6.0.16 | 5.1 | 5.1.26 |
| 6.7 | 6.7.9 | 5.9 | 5.9.18 | 5.0 | 5.0.29 |
| 6.6 | 6.6.9 | 5.8 | 5.8.17 | 4.9 | 4.9.33 |
| 6.5 | 6.5.12 | 5.7 | 5.7.19 | 4.8 | 4.8.32 |
| 6.4 | 6.4.12 | 5.6 | 5.6.21 | 4.7 | 4.7.37 |
Only the latest release (7.1.x) is actively supported; the older branches received this fix as a courtesy.
1. **Update now**: Dashboard → Updates, or your host's control panel. Back up files and database first if you can.
2. If an attack request was answered with 200, or an indicator file exists: treat the site as possibly compromised.
Look for admin users you don't know, PHP files in `uploads` and `/tmp`, and change passwords and keys after cleaning.
3. Stopgap until you can update: block requests whose `pagename` contains `../` or `%2e%2e` at your WAF.
- [WordPress 7.1.2 Release (WordPress.org, 2026-09-22)](
- [GHSA-7hp8-65ch-5whp](
- [CVE-2026-87902: Attackers started probing WordPress sites hours after the patch (Patchstack)]( — attack requests, preconditions, indicators
- It checks the core only. Plugins and themes have their own vulnerabilities.
- Indicators are the published ones; `[ok]` does not prove a site was never attacked.
Moving to PHP 8 as well? See [php8-upgrade-check](
サーバーにある**すべての WordPress の本体の版**を、読み取りだけで確かめるスクリプトです。
2026-09-22 の WordPress 7.1.2 で直った**重大な脆弱性 CVE-2026-87902**（ログイン不要）の修正済みの版を、系列ごとに持っています。
bash check.sh ~/public_html # フォルダの下の WordPress を全部
bash check.sh --log ~/logs/access_log ~/public_html # アクセスログから攻撃の痕跡も探す（.gz も可）
bash check.sh --online ~/public_html # wordpress.org に、版が最新か・危険かも問い合わせる
- **読み取りだけ**です。PHP も WP-CLI もサイトのコードも実行せず、`wp-config.php` の秘密の値も表示しません
- `--online` のときだけ `api.wordpress.org` に 1 回問い合わせます（あなたのサイトには接続しません）
1. すぐ更新する（管理画面の「更新」、またはサーバー会社の管理画面）。できれば先にバックアップ
2. 攻撃の通信に 200 で応えていた、または痕跡のファイルがあった場合は、侵入された前提で調べる
（知らない管理者ユーザー、uploads や /tmp の PHP ファイル。掃除のあとでパスワードと鍵を変える）
3. すぐ更新できない間は、`pagename` に `../` や `%2e%2e` を含む通信を WAF で止める
[WordPress・PHP の更新（IT.Skill）](
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
