WordPress site owners should treat the July 17, 2026 security release as urgent. WordPress 7.0.2 fixes one critical issue and another SQL injection issue that can affect current WordPress installations, depending on version.
The most serious advisory is CVE-2026-63030, a REST API batch-route confusion issue that can combine with CVE-2026-60137, an SQL injection issue, to allow SQL injection and potentially remote code execution on affected WordPress 6.9.x and 7.0.x sites. WordPress also backported fixes for affected 6.8 and 6.9 branches.
Who needs to update immediately?
According to the WordPress security release and GitHub advisories, WordPress 7.0.0 through 7.0.1 should update to WordPress 7.0.2, WordPress 6.9.0 through 6.9.4 should update to 6.9.5, and WordPress 6.8.0 through 6.8.5 should update to 6.8.6. Versions prior to 6.8 are reported as not affected by this release, but older WordPress versions still carry separate security risk and should not be left unsupported.
What should business owners do today?
- Log in to WordPress and confirm the core version under Dashboard Updates.
- Run a full backup before making changes, including files and database.
- Update WordPress core to the patched version available for your branch.
- Update plugins and themes after the core update, then remove anything unused.
- Test the homepage, forms, checkout or booking paths, and mobile navigation.
- Review admin users and remove accounts that should no longer have access.
- Ask your developer or host to review logs if the site was exposed before patching.
Why this matters for small businesses
Remote code execution risk is serious because it can give attackers a path to run malicious code on the server. Even when public exploitation has not been confirmed, attackers move quickly after security releases disclose affected versions. Waiting several days can leave a business website exposed during the window when automated scanners are looking for vulnerable targets.
Do not rely only on automatic updates
WordPress said forced updates were enabled for affected versions, but business owners should still verify that their own site actually updated. Hosting configuration, file permissions, managed WordPress rules, or disabled background updates can prevent automatic updates from completing. Verification is faster than recovery after a compromise.
Sources for this alert
This post is based on the official WordPress 7.0.2 security release, the GitHub advisory for CVE-2026-63030, the GitHub advisory for CVE-2026-60137, and the NVD record for CVE-2026-63030.
If you manage a South Florida business website and are not sure whether your WordPress install is patched, contact iDvlpr Marketing. We can check the version, verify backups, apply updates, review admin access, and confirm the critical pages still work after the update.