Open-source business platforms, week 39 of 2026: exploited WordPress flaw leads 17 CVEs

The release at a glance

The week 39 roundup covers open-source business platform advisories published between 21 and 27 September 2026. In scope are 17 CVEs: one critical, eight high and eight medium. GLPI accounts for 13 of the 17, with WordPress, Server, Frappe Framework and ERPNext accounting for one each. The release is led by CVE-2026-87902, a WordPress page-template flaw that can lead to remote code execution under certain server and theme conditions. CISA added it to KEV on 25 September 2026, and ENISA's EUVD records exploitation since 23 September 2026. CISA's due date for KEV remediation is 28 September 2026.

What matters most

WordPress. CVE-2026-87902 is the priority. An unauthenticated attacker can make page-template resolution include a chosen readable PHP file outside the active theme; if server and theme pre-conditions align, this leads to remote code execution. It is fixed in WordPress 7.1.2, with backported fixes listed from 4.7.37 through 7.0.6. This is the only issue in this week's scope known to be actively exploited, as recorded by CISA KEV and ENISA EUVD. It has its own advisory page on this site.

GLPI. Thirteen items are in scope, mostly high. CVE-2026-48482 is the critical one: a form administrator can use a crafted Form import to write a file outside the custom-asset directory and invoke it remotely; fixed in 11.0.8. CVE-2026-47679 allows any logged-in user to request deletion of an attacker-selected server file; fixed in 10.0.26 and 11.0.8. CVE-2026-53625 lets a technician change another user's authentication method through the API, which can enable account takeover under legacy API REST or SSO configurations; fixed in 10.0.26 and 11.0.8. CVE-2026-53629 is SQL injection in the history tab for users with READ rights on logs; fixed in 10.0.26 and 11.0.8. CVE-2026-55214 is stored XSS in supplier website fields, CVE-2026-53610 is reflected XSS in dashboards, and CVE-2026-49470 is missing rate limiting on TOTP verification; these are fixed in 11.0.8. Several of these GLPI flaws also have their own advisory pages on this site.

Patch in this order

1. WordPress: apply 7.1.2, or the appropriate backported release listed in the advisory, for CVE-2026-87902. It is actively exploited and in CISA KEV; CISA's due date is 28 September 2026. Identify internet-exposed WordPress instances first.

1. GLPI installations before 11.0.8: update to 11.0.8. This addresses CVE-2026-48482, CVE-2026-47679, CVE-2026-53625, CVE-2026-53629, CVE-2026-55214, CVE-2026-53610, CVE-2026-49470, CVE-2026-53626, CVE-2026-53627 and CVE-2026-53628.

1. GLPI 10.0 installations before 10.0.26: update to 10.0.26. This addresses CVE-2026-47679, CVE-2026-53625, CVE-2026-53629, and CVE-2026-53628.

1. Server 32.0.0 to 34.0.0: no fixed version or workaround is stated for CVE-2026-77165 in the CVE record.

1. For the remaining medium-severity advisories affecting Frappe Framework, ERPNext and GLPI, no fixed versions are stated in this roundup; follow the vendor advisories as they are released.

Beyond the patch

Next month, reuse the same discipline: inventory your internet-facing WordPress and GLPI instances, then patch the exploited item before the long tail. Managed Detection & Response is the fit where exploitation is already active, and Implementation & Assessment Services can test and harden a public WordPress or GLPI deployment ahead of the next release.