WordPress 7.0.2 Core security fix: what site owners need to do

WordPress released an urgent Core security update on July 17, 2026 after two vulnerabilities were disclosed. One involved SQL injection through WP_Query; the second involved REST API batch-route confusion and could be chained with the SQL injection flaw to reach remote code execution on affected versions.

What was fixed?

The July release addressed two separate WordPress Core issues:

Which WordPress versions are affected?

WordPress stated that versions before 6.8 are not affected by these two specific vulnerabilities. That does not mean an older branch is generally safe: only the latest WordPress release is fully maintained, and old installations can contain other unresolved security problems.

Why this incident matters

Most high-profile WordPress incidents involve a vulnerable plugin or theme. This case is different because the vulnerable code is in WordPress Core itself. A Core flaw can affect a much broader range of sites, including otherwise carefully maintained installations with reputable plugins.

The risk is also not limited to visibly damaged websites. Successful exploitation can begin with database access or credential exposure and later progress to malicious administrators, modified files, scheduled tasks, web shells, redirects, spam pages, or persistent backdoors.

How to update safely

1. Confirm your current version. Check Dashboard → Updates or run wp core version through WP-CLI.
2. Create a verified backup. Back up both files and database before a manual update, especially on WooCommerce, membership, or custom sites.
3. Install the security release. Update to the newest available WordPress version. At minimum, affected branches need 6.8.6, 6.9.5, or 7.0.2.
4. Clear all cache layers. Purge page cache, object cache, CDN cache, reverse-proxy cache, and PHP OPcache where relevant.
5. Test critical functionality. Verify login, checkout, payments, forms, scheduled actions, REST integrations, and custom code.
6. Confirm the update actually persisted. Recheck the Core version and inspect hosting dashboards that may use immutable or managed WordPress filesystems.

Updating is necessary, but it may not be enough

Installing the patched version closes the known vulnerabilities. It does not automatically remove a compromise that occurred before the update. Because both CVEs were added to active-exploitation tracking, sites that remained exposed should receive at least a focused post-update review.

Post-update compromise checklist

What not to do

• Do not assume the website is safe only because the homepage looks normal.
• Do not rely exclusively on one security-plugin scan.
• Do not delete suspicious files before preserving evidence and a backup.
• Do not reinstall Core and assume plugins, themes, uploads, database content, or server tasks are clean.
• Do not postpone the update while waiting for a maintenance window if the site is on an affected release.

Was every WordPress site automatically updated?

WordPress enabled forced security updates for affected installations, but background updates can fail because of filesystem permissions, disabled update constants, hosting restrictions, version-control deployments, disk-space problems, timeouts, or previous failed updates. The only reliable approach is to check the installed version directly.

Do you need a full malware cleanup?

A complete cleanup is appropriate when you find unknown administrators, modified files, suspicious scheduled tasks, unexplained redirects, spam pages, hosting warnings, unexpected database changes, or evidence that the site was exposed and actively targeted. A business-critical WooCommerce or membership site may justify deeper review even when there are no obvious symptoms.