Fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, several stored XSS issues (block markup, Interactivity API, Customizer selective refresh, Categories, Playlist, image and comments pagination blocks), leaking of unpublished Customizer changesets, and Notes readable by users who cannot edit the post. Root certificates were updated after the eMudhra revocation.
Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7.
Seven security fixes, including a stored XSS on the Comments admin page, a DoS in WP_Http::make_absolute_url(), a second-order SQL injection in WXR export, Author users able to sticky posts, unauthenticated disclosure of comments on private posts, and forgeable parameters to the {status}_{type} hook.
Update to WordPress 7.1.3 or later (7.1.4 is current).
An unauthenticated attacker could, under certain conditions, make page template resolution include a readable local PHP file outside the active theme, which can lead to remote code execution (CVE-2026-87902).
Fixes include stored XSS in wpautop(), an HTML API set_modifiable_text() comment breakout, authenticated path traversal in the REST Templates controller, Contributor+ arbitrary post overwrite, and comments (including notes) that any logged-in user could reparent.
Authenticated Author+ users could achieve remote code execution through a malicious file upload on sites using Imagick and Ghostscript (CVE-2026-65640).
Update to the latest 7.0.x or 7.1.x release, especially on servers with Imagick and Ghostscript.
WordPress 7.0.2 fixes critical SQL injection and RCE
Fixes a facilitated SQL injection and a REST API batch-route confusion with SQL injection leading to remote code execution. Forced auto-updates were enabled. Fixed versions also include 6.9.5 and 6.8.6.
Make sure no site runs 7.0.0 or 7.0.1, or a 6.9/6.8 release older than 6.9.5/6.8.6.
