Outage in Liquid Web
Security Advisory: Critical WordPress Vulnerability - "Click2Shell"
Resolved MinorIncident Report
Summary AI Generated
A critical WordPress security vulnerability called "Click2Shell" (CVE-2026-87902) was identified affecting all WordPress versions prior to 7.1.2, enabling unauthenticated Remote Code Execution when an administrator visits a malicious link. Liquid Web's engineering team assessed the hosting fleet while strongly advising all customers to immediately update all WordPress installations — including staging and development environments — to version 7.1.2. The incident was resolved after approximately nine days, with customers on automatic security updates receiving the patch automatically and all others urged to manually verify their WordPress version.
WordPress has identified a critical security vulnerability designated as "Click2Shell" affecting all WordPress versions prior to 7.1.1. This vulnerability can enable unauthenticated Remote Code Execution (RCE) when a logged-in administrator visits a specially crafted link.
Current Status & Hosting Actions
Our engineering team is currently assessing our entire hosting fleet and determining next steps.
There are currently no known workarounds for this vulnerability other than upgrading to the latest version of WordPress.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to review their environments immediately and update to WordPress version 7.1.1.
We will continue to monitor the situation closely and provide further updates as new information becomes available.
Trusted by 1,000+ teams
The Status Page Aggregator with Early Outage Detection
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
RESOLVED
14 days ago - at 10/01/2026 06:29PM
This incident is now resolved. All customers are strongly encouraged to confirm the Wordpress version for all of the websites, including those in staging or development, have been updated to the latest minor version of Wordpress released on September 22nd in order to protect the website from this exploit.
For additional information, please refer to the official WordPress security announcements:
https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
https://wordpress.org/documentation/wordpress-version/version-7-1-2/
MONITORING
20 days ago - at 09/25/2026 07:36PM
Liquid Web Systems Engineers continue to monitor this situation closely. All Customers are strongly encouraged to confirm that all Wordpress websites they host, including those in staging or development, have been updated to the latest minor version of Wordpress released on September 22nd in order to protect the website from this exploit. Customers with automatic security updates enabled should receive the applicable update automatically; however, we recommend verifying the currently running WordPress version.
For additional information, please refer to the official WordPress security announcements:
https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
https://wordpress.org/documentation/wordpress-version/version-7-1-2/
If you have any questions or need assistance with the update process, please contact our Support team. You can reach us through the following channels:
Live Chat via the Customer Portal: https://my.liquidweb.com/
Email: support@liquidweb.com
We appreciate your patience and understanding as we work to secure your services.
IDENTIFIED
22 days ago - at 09/23/2026 06:36AM
Our Engineering team continues to assess and work on the WordPress security vulnerabilities across our hosting fleet.
A new critical vulnerability, CVE-2026-87902, has been disclosed. WordPress 7.1.2 includes the security fix for this vulnerability.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to update to WordPress version 7.1.2 immediately.
We will continue to monitor the situation closely and provide further updates as new information becomes available.
INVESTIGATING
23 days ago - at 09/22/2026 08:13PM
WordPress has identified a critical security vulnerability designated as "Click2Shell" affecting all WordPress versions prior to 7.1.1. This vulnerability can enable unauthenticated Remote Code Execution (RCE) when a logged-in administrator visits a specially crafted link.
Current Status & Hosting Actions
Our engineering team is currently assessing our entire hosting fleet and determining next steps.
There are currently no known workarounds for this vulnerability other than upgrading to the latest version of WordPress.
Recommended Action for Customers
We strongly advise all customers managing WordPress installations to review their environments immediately and update to WordPress version 7.1.1.
We will continue to monitor the situation closely and provide further updates as new information becomes available.
Latest Liquid Web outages
Premium business email Webmail Access Issues - 1 day ago
PBE Webmail Access Issues - 3 days ago
Lansing DC Rack Outage - 22 days ago
The Status Page Aggregator with Early Outage Detection
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
