The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) issued an urgent warning about a critical WordPress vulnerability. CVE-2026-87902 allows an attacker who is not logged in to WordPress to load a malicious, readable PHP file outside the active theme directories. An exploitation activity was also reported involving public scanning and proof-of-concept tools, bringing increased risk of automated attacks to internet-facing websites. The TT-CSIRT notice is not evidence that all regional websites face the same exposure and does not identify a breached Trinidad and Tobago organization or establish how many Caribbean websites are affected.
Caribbean organizations running WordPress on their websites are advised to immediately update WordPress to version 7.1.2 or the applicable patch release. The TT-CSIRT also recommends checking for signs of compromise and ensuring updates are applied accordingly, including:
Confirm the applicable patched release
Examine logs and unexpected PHP files
Investigate suspicious activity; don’t assume an update resolves an earlier intrusion
Verify automatic updates; don’t presume they are running successfully
Leaders can make the response concrete by asking the person responsible for the website to document its current version, when the patch was applied, and whether the compromise review found anything requiring follow-up. If hosting, maintenance, and security monitoring sit with different providers, assign one owner to bring those answers together. The useful outcome is a verified status for each site and a clear route for handling any unresolved finding.
TAKEAWAY: Ask your website owner or provider for a documented update and compromise-check status for every WordPress site you operate.
WHY THIS MATTERS: For Caribbean organizations using WordPress, the warning makes website patch status and evidence of compromise an immediate operational concern.
