WordPress released version 7.0.2, a security-focused update that addresses two significant vulnerabilities, including the critical CVE-2026-63030 (often referred to as "wp2shell").
This release fixes:

A facilitated SQL injection issue.
A REST API batch-route confusion vulnerability that, when chained with the SQL injection, could potentially allow unauthenticated remote code execution (RCE).

The combined exploit chain could enable attackers to compromise affected sites without any login credentials or installed plugins. Versions affected include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Earlier versions (prior to 6.8) are not impacted by these specific issues.
WordPress.org has enabled automatic forced updates for eligible sites to help mitigate widespread risk.
Netracom's Response
At Netracom, the security of our clients' WordPress installations is our top priority. Our managed WordPress hosting platform has already applied the 7.0.2 update (along with corresponding patches for supported earlier versions like 6.9.5 and 6.8.6) to all client sites.

Clients on our managed plans benefit from proactive monitoring, automatic security updates, and expert oversight.
No manual action is required for most sites — your websites have been updated automatically.
We recommend that all clients verify their current WordPress version in the dashboard and run a full site scan as a best practice.

If you manage any self-hosted or non-managed WordPress sites, please update to 7.0.2 immediately via the WordPress dashboard or by downloading the latest version from wordpress.org.
Why This Matters
WordPress powers a significant portion of the web, making core vulnerabilities like this a high-priority concern. The rapid response from the WordPress security team, combined with contributions from researchers at Assetnote/Searchlight Cyber and others, demonstrates the strength of the open-source community.
Netracom's managed hosting includes enterprise-grade security measures, regular backups, performance optimization, and 24/7 support from our Australian, UK, and US teams to keep your sites resilient against such threats.
Next Steps for Clients