WordPress Vulnerability Checker — CVE-2026-87902
Enter your site's domain to run a free, read-only check for this vulnerability. We send a few ordinary HTTP GET requests to your homepage and a handful of well-known paths — no attack traffic, no exploitation attempts.
Affected versions
| WordPress core | 6.4.0 – 6.4.3 (all sites below 6.4.4) |
|---|
Checked at: 2026-10-22 (data)
How this check works
- We send a small number of ordinary HTTP GET requests — the same kind a browser sends when visiting your site.
- We never send exploit payloads or attack traffic. The check only reads publicly visible version headers and pages.
- Check results are cached for 10 minutes and are not stored in a database. Your query is not associated with your identity.
FAQ
What is CVE-2026-87902?
CVE-2026-87902 is a WordPress core remote file inclusion vulnerability that is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog. Unpatched WordPress 6.4.x sites are affected; the fix shipped in the 6.4.4 security release.
How do I check my WordPress version for CVE-2026-87902?
Enter your domain above. Our probes read the public version signals every WordPress site exposes: the generator meta tag on the homepage, readme.html, and the feed generator tag. If your version is visible and within the affected range you get a verdict in seconds.
How is this different from WPScan or wpsec?
WPScan requires a registered account and an API token; most penetration-testing services require ownership verification. This checker is free with no signup and no DNS verification: one CVE, one input, an instant three-state verdict with the raw evidence shown.
Why did I get an “Inconclusive” result?
WordPress sites commonly hide their version (security hardening plugins strip the generator tag and readme.html), or sit behind a CDN/WAF that blocks the probe. The result page shows exactly which signals we saw. Check the version in your WP admin dashboard (Tools → Site Health) as the source of truth.
Does “Not detected” mean my WordPress is safe?
No. It means no visible version signal matched the affected range from outside — which is also what a hardened site looks like. Verify the core version in your dashboard and keep automatic background updates enabled.