{"id":900101,"date":"2026-07-20T00:28:35","date_gmt":"2026-07-20T04:28:35","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/?p=900101"},"modified":"2026-07-20T18:02:24","modified_gmt":"2026-07-20T22:02:24","slug":"wordpress-7-0-2-security-release","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/news\/wordpress-7-0-2-security-release\/","title":{"rendered":"WordPress 7.0.2 Security Release Patches Critical RCE Chain"},"content":{"rendered":"\n

WordPress.org shipped the WordPress 7.0.2 security release<\/strong> on July 17, 2026, patching two vulnerabilities that, when chained, allowed an attacker to run code on a default install without logging in. If you manage a WordPress site, update to 7.0.2, or the matching update for your version (6.9.5 or 6.8.6), right now.<\/p>\n\n\n\n

What the WordPress 7.0.2 Security Release Fixes<\/h2>\n\n\n\n

The release fixes two issues that WordPress.org classifies as one critical and one high-severity vulnerability. Neither issue is catastrophic on its own. Combined, they form a pre-authentication remote code execution (RCE) path: an attacker needs no account, no plugin, and no special configuration to exploit it. A single anonymous HTTP request is enough.<\/p>\n\n\n\n

CVE-2026-60137: SQL Injection in WP_Query<\/h3>\n\n\n\n

WordPress core does not properly sanitize the author__not_in<\/code> parameter of WP_Query<\/code>, the class WordPress uses internally to query posts, when untrusted input reaches it. This is an SQL (Structured Query Language) injection weakness, cataloged as Common Weakness Enumeration (CWE) 89.<\/p>\n\n\n\n

The flaw affects WordPress 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. WordPress fixed it in 6.8.6, 6.9.5, and 7.0.2. Full details are tracked under Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-60137<\/a> (GHSA-fpp7-x2x2-2mjf).<\/p>\n\n\n\n

CVE-2026-63030: REST API Route Confusion<\/h3>\n\n\n\n

The second flaw is a route confusion issue in a REST (Representational State Transfer) API batch endpoint, cataloged as CWE-436 (interpretation conflict). The real danger appears when this flaw combines with CVE-2026-60137. An attacker can route a request through the confused endpoint to reach the vulnerable author__not_in<\/code> parameter, turning the SQL injection into full remote code execution.<\/p>\n\n\n\n

This flaw affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress 6.8 is not affected by this half of the chain. WordPress fixed it in 6.9.5 and 7.0.2. WordPress.org tracks the details as CVE-2026-63030<\/a> (GHSA-ff9f-jf42-662q).<\/p>\n\n\n\n

Note:<\/strong> Sources report different Common Vulnerability Scoring System (CVSS) numbers for these two CVEs depending on the scoring authority, and they do not agree on which flaw is the critical one. What matters for your site is not any single number. The two flaws chain into pre-authentication remote code execution, posing a practical risk to any site running an affected version.<\/p>\n\n\n\n

Because of the severity of the chain, WordPress.org enabled forced auto-updates through the core auto-update system for sites running an affected version. If your site allows background updates, it may already be running a patched version. Confirm your version rather than assume.<\/p>\n\n\n\n

What You Should Do<\/h2>\n\n\n\n

Check your WordPress version now. Log in to WP Admin and open Dashboard > Updates<\/strong>. If the version at the top of the page reads anything other than 7.0.2, 6.9.5, or 6.8.6, click Update Now<\/strong>. This is the fastest path for most site owners and does not require access to files or databases.<\/p>\n\n\n\n

If you manage WordPress over SSH, WP-CLI updates core in one command:<\/p>\n\n\n\n