WordPress released 7.0.2 on 17 July 2026, a security release fixing
two vulnerabilities in core. One of them is exploitable without a login,
on a default install, with no plugins involved.
Backports shipped the same day: 6.9.5, 6.8.6, and 7.1 beta2. Versions
prior to 6.8 are not affected.
The two issues
CVE-2026-63030, nicknamed “wp2shell”, is the serious
one. It is a route-confusion flaw in the REST API batch endpoint
(/wp-json/batch/v1), chained with SQL injection to reach
remote code execution. An anonymous HTTP request is enough — no account,
no specific configuration, no third-party plugin. It affects WordPress
6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. It was reported by Adam
Kues at Assetnote / Searchlight Cyber.
CVE-2026-60137 is a SQL injection in
WP_Query. When the author__not_in parameter
arrives as a string rather than an array, core skips its
absint sanitisation and the value reaches the SQL
WHERE clause directly. It affects WordPress 6.8 through
7.0.1, and was reported by TF1T, dtro, and haongo.
Three core files changed in the fix:
class-wp-rest-server.php, class-wp-query.php,
and rest-api.php.
Why this one moved quickly
WordPress.org enabled forced updates through the auto-update system
for sites on affected versions. Core does not do that for most security
releases.
Patchstack reports it has already seen exploitation attempts in its
logs and has deployed mitigation rules. Pre-authentication RCE in core,
rather than in a plugin, is rare — the last comparable case is years
back.
What our clients need to do
Nothing.
Sites on WP Care plans are covered. Core security releases install
automatically, and we verified versions across the sites we manage after
the release went out.
Self-managed sites
Check your WordPress version under Dashboard →
Updates. If you are on 6.8, 6.9, or 7.0 and not on 7.0.2,
6.9.5, or 6.8.6, update now.
If you have disabled core auto-updates, that is worth revisiting.
This release is a good argument for leaving them on.
Sites that genuinely cannot update immediately can block anonymous
REST API access or the batch endpoint at WAF level as a stopgap, though
both can break legitimate functionality — a plugin or integration that
relies on the REST API may stop working.
If you would like a second pair of eyes on whether your site is
patched, get in touch or see our
managed WordPress care plans.
