John Cuthbert 
WordPress released version 7.0.2 on 17 July 2026 — and this isn’t a feature release. It’s a security release patching two vulnerabilities, one of which could lead to remote code execution. If you run a WordPress or WooCommerce site, this is worth your attention today, not next sprint.
What’s actually wrong
Two separate issues, reported responsibly and already patched.
Issue one
- Facilitated SQL injection — reported as a team effort by multiple security researchers. Affects every branch back to 6.8.
Issue two
- REST API batch-route confusion + SQL injection — the more serious of the two, and can lead to remote code execution. Only affects 6.9 and above.
Which version you actually need
Patch versions differ depending on which branch you’re already on — check yours before assuming 7.0.2 is the only option.
- Running 7.0.x? Update to 7.0.2 — patches both issues.
- Running 6.9.x? Update to 6.9.5 — patches both issues.
- Running 6.8.x? Update to 6.8.6 — patches the SQL injection issue; the REST API/RCE issue doesn’t affect this branch.
- Running anything before 6.8? Not affected by either issue, though you’re missing a lot else by staying this far back.
How to apply it
If auto-updates are enabled for minor/security releases (the WordPress default), most sites will already be patched without anyone doing anything — worth confirming rather than assuming. Otherwise, it’s a one-click update from Dashboard > Updates. As always: check a staging copy first if you’re running custom code that touches the REST API directly, then push to production without delay — this isn’t the kind of patch worth sitting on.
If keeping track of core releases like this isn’t something you have time for, that’s exactly what a Development Retainer is for — we monitor these the same day they land, not when something breaks.
