Thank you for your continued support of Double Factory.
Following the disclosure of the WordPress vulnerability CVE-2026-87902, we carried out emergency security updates on October 2, 2026, for the affected websites covered by our maintenance services.
Why we carried out these updates
Under certain combinations of server environment and active themes, the disclosed vulnerability could allow an unauthenticated third party to execute unauthorised operations. WordPress and Xserver have also urged users to update promptly.
A website may look normal even when it has a security issue. We carried out these updates to help protect our clients’ businesses and their website users.
What we did
We updated the affected websites to patched versions within their existing WordPress version series. After updating, we checked:
- Website display
- Operation of the WordPress administration area
- Key website functions
No major issues or faults were identified on the affected websites at the time of these checks. Please refer to the information from your account contact for the status of your individual website.
Ongoing updates and maintenance are necessary
Continued action is needed: in 2026, IPA issued a WordPress vulnerability alert in July, and the fixes discussed here were released in September.
We will continue to help clients maintain a secure operating environment by reviewing security information and carrying out necessary updates and maintenance.
Please contact us if you are unsure about your website’s maintenance status or if it has not been updated for some time.
Our maintenance service / Discuss website maintenance and security