On July 17, 2026, WordPress released version 7.0.2 to patch two vulnerabilities that, when chained together, let an attacker run code on a default WordPress install without logging in at all. WordPress classified it as one critical and one high-severity issue - the kind of release that doesn't happen often, and shouldn't be ignored when it does.
If you're running WordPress yourself, here's what actually happened, in plain language, and what to check.
What Actually Happened
Security researcher Adam Kues found two separate bugs that, on their own, would each be a real problem - but together were much worse.
The first bug was an SQL injection flaw in WordPress core (tracked as CVE-2026-60137). A parameter used internally by WordPress's WP_Query system wasn't being sanitized properly, which meant carefully crafted input could manipulate the site's database queries.
The second bug (CVE-2026-63030) was a "route confusion" issue in a REST API batch endpoint - a part of WordPress that lets multiple API requests get bundled into one. An attacker could use that endpoint to reach the vulnerable database parameter from the first bug, without ever needing a username or password.
Chained together, the two bugs added up to unauthenticated remote code execution - meaning an attacker could potentially take full control of a vulnerable site from the outside, with no login required.
Which Sites Were Affected
- The SQL injection bug affected WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1.
- The REST API bug affected WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 (WordPress 6.8 was not affected by this half of the chain).
- Both are fixed in WordPress 6.8.6, 6.9.5, and 7.0.2. Versions before 6.8 were never affected.
Given the severity, WordPress pushed this out through its automatic background update system - the same mechanism that quietly keeps most WordPress sites patched without anyone touching a dashboard. If your host has automatic updates enabled, there's a good chance your site already updated itself.
What to Check on Your Own Site
- Log into your WordPress dashboard and check the version number shown at the bottom of most admin screens, or under Dashboard → Updates.
- If you're on 6.8.6, 6.9.5, 7.0.2, or newer - you're patched. Nothing further to do.
- If you're on anything else in the affected ranges - update immediately. This isn't a "get to it next week" update.
- If you can't update right away - at minimum, ask your host or developer about blocking unauthenticated access to the REST API batch endpoint (
/wp-json/batch/v1) at the firewall level until you can patch properly.
WordPress powers a huge share of the web, which is exactly why releases like this get attention fast from both defenders and attackers. A patched site closes the door; an unpatched one stays open.
If You're on Firework's Managed WordPress Hosting
This is precisely the kind of update our Managed WordPress Hosting plan exists for. Core and plugin updates are part of what's included, so patches like this get applied as routine maintenance rather than something you have to notice, research, and act on yourself under time pressure.
If you're managing your own WordPress site and this kind of update cycle sounds like more than you want to keep track of, get in touch - it's exactly the problem managed hosting is meant to solve.
For the full technical write-up, see WordPress's official release notes and Aikido Security's breakdown of the vulnerability chain.