WordPress 7.0.2

Remember when WordPress 7.0 shipped back in May, marking a major milestone for the world's most popular CMS? In the months since, the core team has been methodically refining the release through point updates. WordPress 7.0.2, released July 17, 2026, continues that tradition — though this time with a security-critical focus.

What began as the 7.0 line — introducing significant improvements to the Site Editor, performance enhancements, and a streamlined media workflow — has evolved into a stable, battle-tested platform through 7.0.1 and now 7.0.2.

Security Updates

WordPress 7.0.2 is a security release addressing one critical and one high-severity vulnerability. The core team has enabled forced auto-updates for sites running affected versions.

The patched vulnerabilities include:

• Critical: A facilitated SQL injection issue reported by TF1T, dtro, and haongo — this could allow an attacker to manipulate database queries under specific conditions
• High: A REST API batch-route confusion and SQL injection issue leading to potential Remote Code Execution, reported by Adam Kues at Assetnote / Searchlight Cyber

What This Means for You

Because this is a security release, it is recommended that you update your sites immediately. The WordPress.org team has enabled forced updates via the auto-update system for sites running affected versions. To manually update, visit your WordPress Dashboard, click "Updates," and then click "Update Now," or download WordPress 7.0.2 from WordPress.org.

Looking at WordPress's trajectory from 4.9 to 7.0 is remarkable. In 2017, WordPress powered 29% of the web. Today, it's over 43%. The 7.x series represents the platform's maturity — no longer just a blogging tool, but a full-fledged application framework. This security release reminds us that with great reach comes great responsibility, and the core team continues to take that seriously.