WordPress 7.0.2 Security Release Patches Critical RCE Chain

WordPress.org shipped the WordPress 7.0.2 security release on July 17, 2026, patching two vulnerabilities that, when chained, allowed an attacker to run code on a default install without logging in. If you manage a WordPress site, update to 7.0.2, or the matching update for your version (6.9.5 or 6.8.6), right now.

What the WordPress 7.0.2 Security Release Fixes

The release fixes two issues that WordPress.org classifies as one critical and one high-severity vulnerability. Neither issue is catastrophic on its own. Combined, they form a pre-authentication remote code execution (RCE) path: an attacker needs no account, no plugin, and no special configuration to exploit it. A single anonymous HTTP request is enough.

CVE-2026-60137: SQL Injection in WP_Query

WordPress core does not properly sanitize the author__not_in parameter of WP_Query, the class WordPress uses internally to query posts, when untrusted input reaches it. This is an SQL (Structured Query Language) injection weakness, cataloged as Common Weakness Enumeration (CWE) 89.

The flaw affects WordPress 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. WordPress fixed it in 6.8.6, 6.9.5, and 7.0.2. Full details are tracked under Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf).

CVE-2026-63030: REST API Route Confusion

The second flaw is a route confusion issue in a REST (Representational State Transfer) API batch endpoint, cataloged as CWE-436 (interpretation conflict). The real danger appears when this flaw combines with CVE-2026-60137. An attacker can route a request through the confused endpoint to reach the vulnerable author__not_in parameter, turning the SQL injection into full remote code execution.

This flaw affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress 6.8 is not affected by this half of the chain. WordPress fixed it in 6.9.5 and 7.0.2. WordPress.org tracks the details as CVE-2026-63030 (GHSA-ff9f-jf42-662q).

Note: Sources report different Common Vulnerability Scoring System (CVSS) numbers for these two CVEs depending on the scoring authority, and they do not agree on which flaw is the critical one. What matters for your site is not any single number. The two flaws chain into pre-authentication remote code execution, posing a practical risk to any site running an affected version.

Because of the severity of the chain, WordPress.org enabled forced auto-updates through the core auto-update system for sites running an affected version. If your site allows background updates, it may already be running a patched version. Confirm your version rather than assume.

What You Should Do

Check your WordPress version now. Log in to WP Admin and open Dashboard > Updates. If the version at the top of the page reads anything other than 7.0.2, 6.9.5, or 6.8.6, click Update Now. This is the fastest path for most site owners and does not require access to files or databases.

If you manage WordPress over SSH, WP-CLI updates core in one command:

wp core update

wp core update

Run wp core version afterward to confirm the update applied. For a full walkthrough of installing and using WP-CLI on your hosting account, see our Install and Configure WP-CLI guide.

If your site has core auto-updates enabled, keep them on. WordPress ships security fixes like this one through the background update system, specifically so sites stay protected without the owner taking action. Turning auto-updates off trades convenience for a real window of exposure, as this release demonstrates. For more on managing update settings, see InMotion’s guide to automatically updating your WordPress site.

For the full technical writeup, see the official WordPress 7.0.2 release announcement. If you need help updating a site on your InMotion Hosting account, contact our Technical Support team.