WordPress 7.0.2 is a security release that should be applied promptly. WordPress.org reports one critical and one high-severity issue in the 7.0 branch, and has enabled forced automatic updates for affected sites. This is not a release to leave in the normal maintenance queue.
The safe response is still deliberate: confirm a usable backup, let the approved core update complete, clear the cache layers that can hide a changed site, and verify the public and business-critical paths. This checklist is for site owners, agencies, and hosting teams.
Which WordPress versions need attention
WordPress has released fixes for the supported affected branches:
- Update the WordPress 7.0 branch to 7.0.2.
- Update the WordPress 6.9 branch to 6.9.5.
- Update the WordPress 6.8 branch to 6.8.6.
- Move WordPress 7.1 test sites to beta 2 before further testing.
The official WordPress 7.0.2 release announcement says that releases before WordPress 6.8 are not affected. Do not treat that as a reason to defer unrelated maintenance on an old, unsupported site; it only describes the two issues fixed by this release.
Why this update is urgent
WordPress identifies a critical SQL injection issue and a high-severity REST API batch-route issue that can lead to remote code execution. The announcement lists CVE-2026-60137 and CVE-2026-63030. Keep public discussion focused on patching and verification rather than testing the issues against production sites.
Eligible sites may update automatically. Check the installed version anyway. An automatic core update changes files; it does not prove that the site’s cache, theme, plugins, checkout, forms, or monitoring all remained healthy.
Before the update: confirm a real restore path
Start with a current backup that includes both WordPress files and the database. Confirm where it is stored and who can restore it. For important sites, use the WordPress backup and restore-point checklist and the backup restore test guide before beginning.
Record the installed WordPress version, active theme, and any business-critical plugins or custom features. Avoid bundling unrelated major plugin, theme, PHP, or hosting changes into this security update unless an immediate compatibility requirement has been confirmed.
Apply the WordPress security update
- Confirm the backup and restore point.
- Check the site dashboard or managed-host control panel for the matching supported core release.
- Apply the normal WordPress core update approved for the site and let it finish without starting a second update.
- Sign in again and confirm the installed version.
- Clear the page, object, and CDN cache layers used by the site.
- Open the public site in a private browser window before calling the work complete.
For a portfolio of sites, start with the most exposed or business-critical sites, then use a representative site for compatibility checks before moving through the remaining low-risk group. The WordPress update-window guide can help teams assign checks and keep the change controlled.
Post-update verification checklist
- Open the home page, a key landing page, a recent post, and a contact page without a logged-in session.
- Confirm the WordPress dashboard reports the expected version.
- Open a representative editor screen and confirm blocks, templates, and media controls load normally.
- Submit a monitored test form where the site’s normal process permits it.
- For a store, check product pages, cart behavior, checkout, account access, and transactional email.
- For membership, booking, donation, or learning sites, test one visitor journey and one staff workflow.
- Review error monitoring and the host error log for repeatable new failures.
- Check key pages for normal performance and search behavior after cache clearing.
Use the WordPress performance-after-updates guide for the public performance check. For canonical URLs, crawlability, sitemaps, and important search pages, use the WordPress SEO monitoring guide. Sites behind a CDN should also follow the WordPress CDN update checklist.
If something breaks after the update
Pause the next site in the batch, capture the time and visible symptom, and check the public page separately from the logged-in dashboard. Rule out a stale cache before changing code. If a theme, plugin, or custom integration is likely involved, use the documented restore point or a staging copy instead of trial-and-error changes on a customer-facing site.
If the site cannot be stabilized promptly, restore the known-good state, clear the relevant caches, and verify the public site before scheduling a compatibility review. The Fix I.T. Phill WordPress Support hub collects maintenance, recovery, migration, and hardening guidance.
WordPress 7.0.2 security update FAQ
Is WordPress 7.0.2 a security release?
Yes. WordPress describes 7.0.2 as a security release with one critical and one high-severity fix, and recommends updating affected sites immediately.
Will the update happen automatically?
WordPress has enabled forced automatic updates for affected versions. Verify the installed version and the site’s important workflows even when the update was automatic.
Which older branches receive fixes?
WordPress released 6.9.5 and 6.8.6 for the affected supported branches. Versions before 6.8 are not affected by these two reported issues, according to the official release announcement.
Where can I review the official release information?
See the WordPress 7.0.2 security release announcement and the official WordPress update documentation.