WordPress 7.0.2 was released on July 17, 2026. It is a security release that addresses one critical and one high severity issue. Because of the severity, the WordPress.org team enabled forced updates through the auto update system for sites running affected versions.
Security fixes in this release
According to the official announcement, the two issues are:
- A facilitated SQL injection issue (CVE-2026-60137)
- A REST API batch route confusion and SQL injection issue leading to remote code execution (CVE-2026-63030)
Which versions are affected
- WordPress 6.9 is affected by both issues, and 6.9.5 contains fixes for both
- WordPress 6.8 is affected only by the first issue, and 6.8.6 contains the fix
- WordPress 7.1 beta was affected by both, and 7.1 Beta 2 contained the fixes
- Versions of WordPress before 6.8 are not affected
Forced auto updates and REST API testing for WordPress 7.0.2
Forced updates are rare, and they signal how serious this is. A remote code execution path through the REST API is the kind of issue attackers move on quickly. Even with forced updates, some sites will not update on their own, for example when automatic updates are disabled in code or file permissions block the update. Those are the sites to check first.
Headless builds, mobile apps and integrations that rely heavily on the REST API should be tested after the update to confirm their requests still behave as expected.
Facilitated SQL injection (CVE-2026-60137). SQL injection puts the data in your database at risk, from customer details to order history. We confirm that every site we manage is on 7.0.2, or on the patched release for its branch, such as 6.9.5 or 6.8.6, and we do not count a site as done until we have seen the version number ourselves.
REST API batch route confusion leading to remote code execution (CVE-2026-63030). Remote code execution means an attacker could run their own code on your server, which is as serious as WordPress issues get. Forced updates help, but we do not rely on them: we update any site where automatic updates were blocked, then test REST API dependent features like headless front ends, mobile apps and integrations that send batch requests.
Want WordPress 7.0.2 and every release after it handled for you? Our support and maintenance plans cover tested core, theme and plugin updates, uptime monitoring and help when something breaks. Questions about your site? Contact us and we will take a look.
