WordPress Just Patched a Critical Security Flaw, Here’s What to Check on Your Site

On 17 July 2026, WordPress.org pushed out an emergency release, version 7.0.2, to fix a security issue serious enough that the WordPress security team enabled forced automatic updates for affected sites rather than waiting for owners to act. Given that WordPress powers a substantial share of the web, including a good number of the small business sites we look after, it’s worth a few minutes to understand what happened and check your own site is covered.

What actually went wrong

The headline issue, nicknamed “wp2shell”, is a pre-authentication remote code execution vulnerability (CVE-2026-63030). In plain terms, it chains a mix-up in how the REST API handles batch requests with a SQL injection flaw, and the result is that an attacker doesn’t need a login, a vulnerable plugin, or any unusual configuration to exploit it. A default WordPress install can be targeted with nothing more than a normal HTTP request. A second issue, CVE-2026-60137, is a related SQL injection flaw reported separately.

Which versions are affected

WordPress 6.9 was affected by both vulnerabilities and has been patched in version 6.9.5. WordPress 6.8 was affected by the SQL injection issue only, patched in 6.8.6, and the current branch has moved to 7.0.2. Because of how serious the combination of issues is, security researchers have been blunt about the urgency, describing it as one to patch immediately rather than on the next routine maintenance window.

What to check on your own site

If someone else manages your hosting and updates for you, they’ve most likely already handled this, but it’s still worth a quick check rather than assuming. A few things worth confirming:

• Log into your WordPress dashboard and check the version number under Updates, it should read 6.8.6, 6.9.5, or 7.0.2 or later.
• Check whether automatic updates for core are switched on, and don’t assume they always run silently in the background without any oversight.
• If you’re on shared or budget hosting with an older, heavily customised install, confirm with your host or developer that the patch has actually been applied, rather than just forced by default.

This is exactly the kind of thing that falls through the cracks on sites nobody actively maintains, which is a large part of what ongoing WordPress support and security cover exists to catch before it becomes a problem rather than after.

What stands out about this release isn’t just the severity, it’s that WordPress.org didn’t leave it to site owners to notice and act. Forced updates for a security issue this significant are still relatively rare, and it’s a reasonable sign of how seriously the core team is treating vulnerabilities that require zero effort from an attacker. For anyone running an older or heavily modified WordPress site, that’s worth keeping in mind well beyond this particular patch.