WordPress has shipped version 7.0.2, an urgent security release addressing one critical and one high severity vulnerability. Given the severity of the issues, the WordPress.org team has enabled forced updates through the auto-update system for affected sites, meaning many installations will already be patched automatically.
Site owners who manage updates manually should not wait. You can update immediately from the WordPress Dashboard under Updates, or download version 7.0.2 directly from WordPress.org. Hosts and site owners with automatic background updates enabled should see the patch applied without any action needed.
What was fixed
The release addresses two distinct issues:
- A facilitated SQL injection vulnerability, reported as a team effort by researchers TF1T, dtro, and haongo.
- A REST API batch-route confusion bug leading to SQL injection and potential remote code execution, reported by Adam Kues of Assetnote / Searchlight Cyber.
Both issues are tracked under CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf) and CVE-2026-63030 (GHSA-ff9f-jf42-662q).
Backports for older versions
WordPress has also backported fixes to supported older branches:
- WordPress 6.9 was affected by both vulnerabilities and has been patched in version 6.9.5.
- WordPress 6.8 was affected only by the first vulnerability and has been patched in version 6.8.6.
- The in-progress WordPress 7.1 beta was affected by both issues and has been fixed in beta2.
Versions prior to 6.8 are not affected, according to WordPress.org.
Why this matters for site owners
SQL injection and remote code execution vulnerabilities rank among the most dangerous class of WordPress security issues, since successful exploitation can lead to full database compromise or a completely hijacked site. Because forced updates are already rolling out, most sites on affected versions should update automatically, but site owners running custom update configurations, staging environments, or older unsupported branches should verify their version and apply the patch manually without delay.
The release was led by John Blackbourn and Barry Abrahamson, with contributions from a large group of core developers and representatives from hosting and infrastructure companies including Automattic, Bluehost, Cloudflare, GoDaddy, Hostinger, and WP Engine.