WordPress 7.0.2 fixes critical core flaws, and attacks began within hours

WordPress released version 7.0.2 on July 17, 2026 to fix two security issues in WordPress core itself, one rated critical and one high. Because the flaws were in core, not in a plugin, every site on an affected version was exposed. WordPress turned on forced updates for those sites through its auto-update system.

What was fixed

The release post lists two issues: a facilitated SQL injection, and a REST API batch-route confusion with SQL injection “that can lead to Remote Code Execution”. They are tracked as CVE-2026-60137 and CVE-2026-63030.

Branch	Affected by	Fixed in
7.0	Both issues	7.0.2
6.9	Both issues	6.9.5
6.8	The first issue only	6.8.6
Older than 6.8	Not affected	-

The 7.1 beta was also affected and was fixed in 7.1 beta 2.

How fast attackers moved

Security firm Patchstack, which protects WordPress sites with firewall rules, published what it saw in the days after the fix:

• The first exploitation attempts came roughly 90 minutes after 7.0.2 was released, about three hours after the fix was committed publicly.
• It blocked more than 65,000 attempts from more than 1,500 IP addresses.
• 97% of the blocked requests targeted the REST batch endpoint, and some tried the full chain to create an administrator account.

Who is affected

Any self-hosted WordPress site that stayed on 6.8.0 to 6.8.5, 6.9.0 to 6.9.4, or 7.0.0 to 7.0.1. Sites whose host or settings block automatic background updates did not get the forced update and had to be updated by hand.

What to do

Open Dashboard > Updates and check the version number. Anything on the 7.0 branch below 7.0.2 needs an update now; better still, move to 7.1.3 (released October 6, 2026) or later. When you compare hosts, ask whether they apply WordPress core security releases automatically and how quickly, and whether they block attacks at the firewall while you update.