How fast can you start?

Most rescues begin the same day you submit your request. Priority is given to managed hosting clients.

What does the rescue process look like?

Deep forensic scan of your database, files, and code. Every threat removed, site hardened with 15-point checklist, then migrated to isolated infrastructure.

What does the clean guarantee cover?

As long as your site is on Delvok managed hosting, it is monitored 24/7. If malware returns, we handle it at no extra charge. Continuous protection, always.

How do you handle my credentials?

Encrypted with 256-bit AES in transit and at rest. Automatically deleted after rescue completes.

Why no phone support?

Written communication leads to faster, more accurate results. Every detail is documented, nothing gets lost.

What happens to my hosting after rescue?

Your site is migrated to isolated container infrastructure with dedicated web root, database, and server process. 24/7 monitoring included.

Can you rescue WooCommerce sites?

Yes. That is the Rescue Pro tier, built for WooCommerce, membership sites, and complex applications.

Will Google remove the malware warning?

We submit removal requests to Google and all major security databases, and resubmit your sitemap.

What if my site needs more than malware removal?

Additional services are being built. If your site needs redesign or development, Delvok will reach out about options.

← Back to Blog

Vulnerability Alert

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

September 30, 2026·Delvok Threat Intel·2 min read

A high-severity security advisory was published regarding WordPress Core.
Tracked as CVE-2026-87902 with a CVSS severity score of N/A/10.

Executive Threat Summary

WordPress has released security updates for a critical unauthenticated path traversal vulnerability that can lead to local PHP file inclusion and, on affected server and theme configurations, remote code execution. Site owners should update WordPress Core immediately.
The post PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core appeared first on Wordfence.

This security vulnerability presents a direct risk of unauthorized data access, arbitrary script injection, or remote site compromise if left unaddressed. Because threat actors scan the internet automatically within hours of vulnerability disclosures, affected sites must be audited immediately.

Action Plan for Website Owners

Check Your Installed Version: Verify what version of WordPress Core is running in your WordPress admin dashboard (Plugins → Installed Plugins).
Apply Patches Immediately: If a newer release is available, backup your database and update the software without delay.
Inspect for Indicators of Attack: If your site cannot be updated immediately, check for unexpected administrative accounts or unusual traffic spikes.
Get an Infrastructure Audit: Submit a rescue or security inquiry with Delvok. We verify server integrity and migrate your site to an isolated container environment.

What Delvok Does Differently

Every site we rescue is migrated to isolated container infrastructure — your own web root, database, and server process. 24/7 monitoring catches threats before they become problems. Forensic-grade remediation ensures nothing is left behind.

Get Protected