WordPress has released an emergency security update, and this one deserves your immediate attention. On July 17, the WordPress security team published WordPress 7.0.2, which fixes a critical vulnerability that lets an attacker take over a standard WordPress installation without logging in. No plugins or themes need to be involved.
The severity shows in an unusual step: WordPress.org has enabled forced automatic updates for all sites running affected versions. If your site is on a vulnerable version, update today.
What Happened
The critical issue combines a REST API batch-route confusion with SQL injection, which together allow remote code execution. The entry point is the REST API batch endpoint (/wp-json/batch/v1), present on every standard WordPress installation. Put simply, an anonymous attacker could gain full control of an unpatched website.
Security researcher Adam Kues of Searchlight Cyber reported the flaw responsibly, so the WordPress team had time to prepare fixes before anything went public. The same release also patches a separate SQL injection issue of high severity.
Which Versions Are Affected
- WordPress 7.0.0 to 7.0.1 → update to 7.0.2
- WordPress 6.9.0 to 6.9.4 → update to 6.9.5
- WordPress 6.8.x → not affected by the takeover flaw, but exposed to the separate SQL injection issue → update to 6.8.6
- WordPress 7.1 beta → fixed in beta 2
- Versions before 6.8 → not affected by either issue
Don’t assume your site updated itself. Check. Log in to your WordPress dashboard and look at the version under Updates. Forced auto-updates cover most sites, but installations with disabled background updates or custom hosting setups can be left behind.
What to Do Right Now
1. Update WordPress. Go to Dashboard → Updates → Update Now, or download the latest version from WordPress.org.
2. If you really can’t update yet, there are temporary measures: block unauthenticated access to the REST API, or block the path /wp-json/batch/v1 and the query parameter rest_route=/batch/v1 at your firewall. Both can break legitimate REST API traffic, so use them only as short-term cover until you patch.
3. After updating, take a look around. If your site ran an affected version for a few days, check for unexpected admin users, recently modified files, or unfamiliar scheduled tasks. If anything looks off, ask your developer or maintenance provider to dig in.
How We’re Handling It at WPM
All websites covered by our maintenance and support packages have been updated to patched versions, and we’re keeping an eye on them as an extra precaution. Situations like this are the whole point of a maintenance plan. When a critical vulnerability drops, sites that get patched within hours stay safe, while sites that wait become targets.
If your website isn’t under active maintenance and you’re not sure where you stand, check your WordPress version today, or get in touch and we’ll help you verify.
Looking Ahead
Critical vulnerabilities in WordPress core are rare, and the response to this one shows the security model working as intended. The flaw was reported privately, fixes were backported across three release branches, and forced updates went out to protect sites at scale, all within days.
Still, no security process replaces the basics: keep your WordPress core, plugins, and themes up to date, and know who’s watching your site when an update like this lands.
