Hello community!
I'm sharing an important security alert for those using WordPress on their hosting.
A notice has been published about a critical severity vulnerability (CVE-2026-87902) affecting WordPress. This flaw could allow an unauthenticated remote attacker to include a local PHP file located outside the active theme directories and, under certain conditions, execute code remotely on your site.
The list of affected versions is very broad, essentially all branches from 4.7 through 7.1. The fix is to upgrade to the patched version that corresponds to your branch. For example, if you use 7.1, you should upgrade to 7.1.2; if you use 7.0, to 7.0.6; and so on.
Check your sites' WordPress version right now and, if it’s affected, update as soon as possible 
References to solutions, tools, and information 
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
Don’t put it off until tomorrow, this is one of those that won’t forgive you 
Regards, fellow developers 
Sergio Turpín
