WordPress 7.0.2 is out, and it’s an important one. This release patches a critical remote code execution vulnerability along with a high-severity SQL injection issue, the kind of security holes that could let attackers take control of an unpatched site.
Because of how serious these vulnerabilities are, WordPress.org has already started force-pushing this update to sites running affected versions. But you shouldn’t rely on that alone.
You can review the technical details in the official WordPress security advisory.
What We’re Doing
We’re updating all managed client sites to WordPress 7.0.2, or the appropriate patched version for your setup, as a priority this week.
What You Should Check
- Log into your WordPress Dashboard and look under “Updates.”
- If you’re not already on 7.0.2, or 6.9.5 / 6.8.6 depending on your version, update now.
- If you manage your own hosting outside our care, don’t wait. This isn’t a “get to it eventually” update.
- Sites running versions older than 6.8 aren’t affected, but everything from 6.8 up needs attention.
