WordPress 7.0.2 has officially been released as an important security update. The new version addresses two serious vulnerabilities, including one classified as critical and another classified as high severity.
Because of the potential impact of these security issues, WordPress recommends that all affected website owners update their installations immediately. The WordPress security team has also enabled forced automatic updates for websites running vulnerable versions.
What Is Included in WordPress 7.0.2?
Unlike a major WordPress release, version 7.0.2 does not introduce new design tools or user-facing features. Its primary purpose is to fix security vulnerabilities that could potentially allow attackers to access, manipulate, or execute code on affected WordPress websites.
The release fixes the following two issues:
Facilitated SQL Injection Vulnerability
The first vulnerability involves a facilitated SQL injection issue.
SQL injection vulnerabilities may allow an attacker to manipulate database queries. Depending on the circumstances and the affected website configuration, this type of vulnerability could expose sensitive information or allow unauthorized database operations.
This issue was responsibly reported by security researchers TF1T, dtro, and haongo.
REST API Vulnerability Leading to Remote Code Execution
The second vulnerability involves route confusion within the WordPress REST API combined with SQL injection.
According to the official release announcement, this vulnerability could potentially lead to remote code execution. Remote code execution is particularly serious because it may allow an attacker to run unauthorized code on a vulnerable server.
The issue was reported by Adam Kues of Assetnote/Searchlight Cyber.
Which WordPress Versions Are Affected?
The WordPress security team released updates for multiple affected branches.
- WordPress 7.0 users should update to WordPress 7.0.2.
- WordPress 6.9 users should update to WordPress 6.9.5.
- WordPress 6.8 users should update to WordPress 6.8.6.
- WordPress 7.1 Beta users should update to WordPress 7.1 Beta 2.
WordPress 6.9 is affected by both vulnerabilities, while WordPress 6.8 is affected only by the first vulnerability. Versions earlier than WordPress 6.8 are not affected by these specific security issues.
Should You Update Immediately?
Yes. WordPress website owners should install the update as soon as possible.
The official WordPress announcement specifically recommends immediate updates because this is a security release. Due to the severity of the vulnerabilities, WordPress has enabled automatic forced updates for affected websites that support background updates.
However, website owners should not assume that every site has updated automatically. Automatic updates may fail because of:
- Incorrect file permissions
- Limited server resources
- Disabled background updates
- Hosting configuration problems
- Custom WordPress configurations
- Previous failed updates
Website administrators should manually check the installed WordPress version to confirm that the update was completed successfully.
How to Update to WordPress 7.0.2
To update WordPress manually:
- Log in to your WordPress dashboard.
- Go to Dashboard → Updates.
- Create a complete backup of your website.
- Click Update to version 7.0.2 or Update Now.
- Wait for the update process to finish.
- Clear your website, server, and CDN caches.
- Test important pages and functionality.
WordPress 7.0.2 can also be downloaded directly from the official WordPress website.
What Should You Back Up Before Updating?
Although security updates are generally designed to be safe and backward-compatible, creating a backup is still recommended.
Your backup should include:
- WordPress database
- Themes
- Plugins
- Uploaded media files
- WordPress configuration files
- Custom code and modifications
For WooCommerce, membership, booking, or high-traffic websites, it may be safer to test the update on a staging environment first. However, because this release fixes critical security issues, testing should be completed quickly rather than delaying the production update for an extended period.
What to Check After the Update
After installing WordPress 7.0.2, review the website carefully.
Check the following areas:
- Homepage and important landing pages
- WordPress administrator dashboard
- Contact and registration forms
- User login and account pages
- WooCommerce cart and checkout
- Payment gateways
- Search functionality
- REST API integrations
- Scheduled tasks and cron jobs
- Email delivery
- Page builders and custom templates
You should also review your PHP error logs and browser console for unexpected errors.
Do Plugins and Themes Need Updating?
WordPress 7.0.2 is a core security release, but plugins and themes should also be reviewed.
Outdated plugins and themes remain one of the most common sources of WordPress security problems. After updating WordPress core, check whether updates are available for:
- Active plugins
- Active theme
- Inactive plugins
- Inactive themes
- Page builders
- WooCommerce extensions
- Security and backup plugins
Remove unused plugins and themes when they are no longer required. Keeping unnecessary software installed increases the potential attack surface of a website.
CVE References
The two security vulnerabilities addressed in this release are associated with the following references:
- CVE-2026-60137
- CVE-2026-63030
These references help security teams, hosting providers, and developers identify and track the vulnerabilities across different security databases.
Final Thoughts
WordPress 7.0.2 is an essential security release rather than an optional feature update. It fixes one critical and one high-severity vulnerability, including an issue that could potentially result in remote code execution.
Website owners, developers, and administrators should verify that every affected WordPress installation has been updated successfully. After updating, they should clear caches, test important functionality, review error logs, and confirm that themes and plugins remain compatible.
Keeping WordPress core, themes, and plugins updated is one of the simplest and most effective ways to reduce the risk of website compromise.
Recommended action: Back up your website and update to WordPress 7.0.2 immediately.