IONOS Canada incident

Critical Security Update: WordPress Core Vulnerability (CVE-2026-87902)

Resolved after 2 days 10 hours, affecting Wordpress Hosting and Wordpress Pro, on September 22, 2026.

identified Sep 22, 2026, 09:38 PM UTC

A critical security vulnerability affects WordPress versions 4.7.0 through 7.1.1, which can allow remote code execution under specific conditions. Managed WordPress Customers No action needed:IONOS is automatically patching your site and deploying proactive security measures Self-Managed WordPress Customers Action required: Update WordPress immediately to the latest version More updates will be posted here as new information becomes available.

Started: Sep 22, 2026, 09:38 PM UTC
Resolved: Sep 25, 2026, 07:57 AM UTC
Duration: 2d 10h
Detected by Pingoru: Sep 22, 2026, 09:38 PM UTC

Affected components

Wordpress HostingWordpress Pro

Update timeline

identified Sep 22, 2026, 09:38 PM UTC

A critical security vulnerability affects WordPress versions 4.7.0 through 7.1.1, which can allow remote code execution under specific conditions. Managed WordPress Customers No action needed:IONOS is automatically patching your site and deploying proactive security measures Self-Managed WordPress Customers Action required: Update WordPress immediately to the latest version More updates will be posted here as new information becomes available.
resolved Sep 25, 2026, 07:57 AM UTC

The issue has been resolved.

Your product runs on more than IONOS Canada

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.