Automattic Wordpress Update Version 7.0.2
Your rating
Rate update installation process
Risk factor
No ratings yet. Be the first to rate this update.
AI enhanced content
Update Summary
WordPress 7.0.2 fixes two security vulnerabilities, including a critical SQL injection issue and a high-severity REST API batch-route confusion issue leading to remote code execution. References: CVE-2026-60137 and CVE-2026-63030. Reference IDs: GHSA-fpp7-x2x2-2mjf, GHSA-ff9f-jf42-662q.
Update Details
Security
- Fixes a critical facilitated SQL injection vulnerability reported by TF1T, dtro, and haongo (CVE-2026-60137 / GHSA-fpp7-x2x2-2mjf).
- Fixes a high-severity REST API batch-route confusion and SQL injection vulnerability leading to remote code execution, reported by Adam Kues at Assetnote / Searchlight Cyber (CVE-2026-63030 / GHSA-ff9f-jf42-662q).
Hints
- Update immediately through Dashboard > Updates > Update Now, download the release from WordPress.org, or rely on automatic background updates where supported.
- Forced updates have been enabled through the auto-update system for sites running affected versions.
- WordPress 6.9 is fixed in version 6.9.5; WordPress 6.8 is fixed in version 6.8.6; and WordPress 7.1 beta is fixed in beta2. Versions before 6.8 are not affected.
Product Information
Vendor: Automattic
Product: Wordpress
Product type: Software
Platform: Web
Version: 7.0.2
Vendor information published: Jul 17, 2026
Original release notes: View on vendor site
Published on updatealert.io: Oct 24, 2026
Description: WordPress is a free and open platform for creating websites and blogs.