When WordPress ships a security release and exploitation starts the same day, the clock is not on your side. CVE-2026-87902 is a good example: core fixed a path-traversal issue that can reach remote code execution on some theme and server setups, and probes showed up within hours of the advisory. The first operational question is simple — which of your sites are still on an unpatched branch?
This is a practical checklist for agencies and in-house ops who manage more than a handful of WordPress installs (and often Joomla beside them). It assumes you already have access to each site or a fleet dashboard; it does not invent host-level magic.
1. Confirm the fixed versions for your branches
Do not guess from a single “latest” number. WordPress backports security fixes across supported branches. For CVE-2026-87902 the fixed line included 7.1.2 and matching backports on older majors. For each site, note:
- The installed major/minor (for example 6.8.x vs 7.1.x)
- Whether auto-updates for core are enabled
- Whether the host or a management plugin is supposed to apply core updates for you
Verify the live version in the dashboard or with wp core version on the server. Assuming the auto-updater ran is how fleets stay half-patched.
2. Inventory the fleet in one place
Logging into twenty admin screens burns the morning. You want a single list of sites with platform, core (or CMS) version, and last-seen status. That is the job of a fleet ops layer such as CMS Inspect: WordPress and Joomla sites in one dashboard, with uptime context next to update and security work.
Free core access covers getting sites onto the dashboard. Advanced operations unlock at $1 per active site per month when you need the fuller ops loop.
3. Separate “needs core update” from everything else
After a critical CVE, noise is the enemy. Plugin and theme update queues can wait an hour. Core security releases should jump the queue when the advisory says they should. In practice:
- Flag every WordPress site below the patched version for its branch
- Note any site where you cannot read the version (access broken, maintenance mode, host lock)
- Park non-security updates so they do not block the patch window
Safer update workflows matter here: queue the core update, run it, and keep an audit trail of what changed and what failed — so you are not reconstructing the morning from chat logs later.
4. Back up before you patch, off the server
Before you push core on a client site, take a recoverable backup. Database and file backups that upload to Google Drive or Dropbox keep recovery copies outside the web root. If a theme or mu-plugin fights the update, you want a restore path that does not depend on the compromised or half-updated box.
5. Patch, then verify — do not trust the badge alone
After the update:
- Confirm the new core version on the site
- Spot-check the front end and wp-admin
- Review server or WAF logs for traversal-style probes if the site was exposed during the window (paths with
.., unusualpagenamevalues, or known PoC user-agents from the advisory write-ups)
Security triage in the same ops dashboard helps keep findings high-signal: suppress verified false positives, work the real queue, and export a short report for the client when they ask what you did.
6. Close the loop for Joomla sites in the same week
Mixed fleets often get a WordPress fire drill and forget Joomla until the next advisory. Recent Joomla security releases (for example the 5.4.9 / 6.1.4 set) fixed multiple core issues in one drop. Use the same inventory habit: version, update path, backup, verify. One dashboard for both platforms keeps that habit honest.
What good looks like by lunchtime
- Every WordPress site on a patched core for its branch, or an explicit exception with a date
- Backups sitting in Drive or Dropbox from before the change
- A short note of what was updated and what is still open
- Uptime and security queues quiet enough that the next CVE does not start from zero
CMS Inspect is built for that loop: monitor, safer updates, cloud backups, security triage, and client-ready reporting for WordPress and Joomla together. Start free on the core dashboard, then unlock advanced ops at $1 per active site per month when the fleet needs it.
