WordPress 7.0.2 Release

WordPress 7.0.2 is a security release addressing one critical and one high severity issue; WordPress urges updating immediately, and the WordPress.org team enabled forced updates via the auto-updater due to the severity. Update via Dashboard → Updates → Update Now or download from WordPress.org — sites with automatic background updates receive it without action.

Critical 5.9 CVSS Aktiv ausgenutzt 2026-07-17

WordPress

Betroffene Versionen

7.0.2

Was das unter einer SharedLicense-Lizenz bedeutet

A critical-plus-high pair in WordPress core is the standard full-site takeover chain — unpatched sites are exposed to whatever the flaws allow, typically attacker-controlled code execution on the hosted site.

WordPress 7.0.2 is now available.

The 7.0.2 security release addresses one critical and one high severity security issue.

Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.

To manually update you can visit your WordPress Dashboard, click “Updates”, and then click “Update Now”, or you can download WordPress 7.0.2 from WordPress.org. On sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release:

A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo
A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber

For more information on this release, please visit the HelpHub site.

Backports

WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released containing fixes for both.
WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released containing a fix.
The beta release of WordPress 7.1 is affected by both vulnerabilities. Version 7.1 beta2 has been released containing fixes for both.
Versions of WordPress prior to 6.8 are not affected.

CVE and GHSA references

Thank you to these WordPress contributors

This release was led by John Blackbourn and Barry Abrahamson. In addition to the security researchers mentioned above, WordPress 7.0.2 would not have been possible without the significant contributions of the following people: Aaron Jorbin, Alex Concha, annezazu, Barry, David Baumwald, Dominik Schilling, Ehtisham Siddiqui, Joe Dolson, Joe Hoyle, John Blackbourn, Jonathan Desrosiers, Marius L. J., Matt Mullenweg, Mohammad Jangda, Peter Wilson, Sergey Biryukov, vortfu, Weston Ruter, plus representatives from Altis, Automattic, Bluehost, Cloudflare, GoDaddy, Hostinger, and WP Engine.

Häufig gestellte Fragen

What does WordPress 7.0.2 fix?

One critical and one high severity security issue in WordPress 7.0.x. WordPress does not list CVE IDs in the announcement; technical per-fix details are published on the WordPress 7.0.2 HelpHub page.

Who is affected?

Sites running the WordPress 7.0 branch before 7.0.2 — the predecessor 7.0.1 release and the initial 7.0.0 launch are in scope.

How do I apply the fix?

Dashboard → Updates → Update Now, or download from WordPress.org. Sites with automatic background updates receive it on their own — verify the running version in the At a Glance panel afterwards.

Why did WordPress force auto-updates for this release?

Due to the severity, the WordPress.org team enabled forced updates via the auto-updater — reserved for the most serious releases, this pushes the fix to every site with background updates enabled regardless of owner action.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen