Review date: September 24, 2026. This is an operational watch for site owners and administrators. It is not evidence that every site running an affected version has been compromised. Use the versions actually installed on each site, and record every action in the site’s emergency-change or other approved operational procedure.
Executive summary
WordPress 7.1.2 was released on September 22, 2026 to fix an unauthenticated path-traversal issue in page-template resolution that can conditionally lead to remote code execution. See the official WordPress release notice. WordPress documentation recommends applying the 7.1.2 security update immediately, with fixes also available for supported older branches. See the official version documentation.
Patchstack reported active probing beginning within hours of the release and identifies versions through 7.1.1 as affected. Read Patchstack’s post-patch probing report. If the site runs 7.1.1 or another affected version, apply the patched release immediately through the emergency change process; do not wait for the next routine change window. That is this article’s operational recommendation based on the patch and probing information, not a guarantee of a security outcome.
Check the WordPress core
Start by recording the installed WordPress core version. Confirm that the site is on 7.1.2 or on a supported patched branch, as applicable to that site. The WordPress documentation provides the release and security-update details. Do not treat a successful update message as a completed investigation. After remediation, test important pages, login, forms, and business-critical tasks. This is a practical editorial checklist and should be adapted to the site’s own architecture.
- Record the current WordPress, plugin, and theme versions.
- Identify sites that were exposed before patching or that run an affected version.
- Apply the relevant update through the emergency change process, and record the time and result.
- Test critical workflows, then review logs if unusual indicators appear.
Do not automatically describe these items as “high priority” as though that were a supplied vendor classification. Patchstack distinguishes currently exploited listings, CVSS severity, and patch-priority categories. Therefore, if this article uses “high priority,” it is this article’s editorial risk classification. See Patchstack’s displayed categories.
Plugins currently listed as exploited vulnerabilities
Patchstack’s current list includes Gravity Forms <=3.1.0.4, Forminator <=1.57.2, ProfilePress <=4.17.1, and The Events Calendar <=6.17.4. Review Patchstack’s current list and thresholds. These are affected-version thresholds, not proof that every installation is compromised.
For each plugin, identify the installed version, review the vendor’s advisory, and apply the vendor’s patched release. This is an operational instruction. The supplied research does not provide patched-version numbers for all four plugins, so this article does not invent or assume them. After updating, test the plugin’s relevant workflows, such as forms, account functions, or event display, according to what the site uses.
TranslatePress: immediate remediation
If TranslatePress is installed at version 3.3.1 or earlier, update to 3.3.2 or later immediately, then test translation and authentication flows. Wordfence documents the affected versions, patched version, and testing step. Wordfence states that exploitation requires automatic string saving to be enabled and the administrator’s profile locale to be a published secondary language. Review the documented conditions. The same report says the vulnerability can expose a password-reset link and enable administrator account takeover. Review the reported security impact.
Testing translation and authentication is a practical editorial recommendation, not proof that the update works in every environment. Check the interface language, login flow, password reset, and any administrative permissions used by the publishing process.
Log-review plan
If a site was exposed before remediation or shows unexpected behavior, investigate across multiple sources. Review web-server access logs for traversal and probing indicators; PHP or application logs for unexpected errors, file-inclusion behavior, or unusual execution; and security-plugin or hosting-provider logs where available. Patchstack describes the review sources and useful hunting signals.
Signals to review include encoded traversal requests, combinations of the page_id and pagename parameters, unexpected OPML output, and related request variations. See Patchstack’s examples of hunting indicators. Suspicious requests are investigation indicators, not proof of compromise. Prioritize checking unexpected administrator accounts, modified files, password-reset activity, and unusual outbound traffic. These are editorial investigation priorities based on the supplied brief, not standalone evidence of an incident.
WordPress.org’s update distribution and its limits
WordPress.org applies a six-hour cooldown to plugin and theme releases distributed through its update API, with automated security analysis during the cooldown. Read WordPress.org’s explanation of the automated review. This is a useful distribution safeguard, but it is not complete security approval, compatibility testing, or a substitute for testing updates in the site’s own staging environment and emergency-change procedures. That is an operational limitation of the mechanism, not a claim that the analysis finds every possible issue.
A practical action for this month
Complete the inventory, compare installed versions with the thresholds above, remediate WordPress and TranslatePress, and update any listed plugin that matches an affected threshold. Then test critical workflows. If logs contain indicators, keep the investigation scope separate from the patching decision, and do not treat one suspicious request as proof of compromise. Because this watch is dated September 24, 2026, recheck versions and advisories when carrying out the work instead of relying on a static copy of the list.