WordPress 7.0.2 forces security updates for wp2shell RCE

WordPress 7.0.2 is out with fixes for a critical remote-code-execution chain and a high-severity SQL injection issue in WordPress core. The WordPress.org team says it enabled forced automatic updates for affected versions because of the severity.

The two identifiers to track are CVE-2026-63030 and CVE-2026-60137. Cloudflare says it deployed WAF protections for all customers using its WAF, including free-plan sites through the Free Ruleset, but the vendor note is explicit: WAF coverage reduces exposure while you update, it does not replace patching.

WordPress branches that need attention

The official release says WordPress 7.0.2 addresses one critical and one high-severity security issue. It also ships backports for affected older branches.

WordPress 6.9 sites should move to 6.9.5, which contains fixes for both vulnerabilities. WordPress 6.8 sites should move to 6.8.6, which fixes the SQL injection issue because that branch is not affected by the RCE. WordPress 7.1 beta users should move to 7.1 beta2. Versions before 6.8 are listed as not affected in the WordPress release note.

Administrators should still verify the installed version instead of assuming auto-update succeeded. Forced updates can fail on locked-down filesystems, custom deployment pipelines, disabled cron behavior, or sites managed through hosting panels that override normal WordPress update flow.

wp2shell combines SQL injection and REST API risk

Cloudflare describes two related vulnerabilities. CVE-2026-60137 is a SQL injection issue affecting WordPress 6.8 and later. CVE-2026-63030 is an unauthenticated RCE issue affecting WordPress 6.9 and later, tied to the REST API batch endpoint when a persistent object cache is not in use.

Rapid7 also tracks CVE-2026-63030 as an unauthenticated WordPress core RCE issue and notes that public advisory information appeared on July 17, 2026. The practical concern is simple: this is core WordPress, not a single plugin with a narrow install base.

That broad exposure is why this belongs in the urgent lane. Even if most managed WordPress sites receive updates automatically, teams responsible for client portfolios, staging environments, headless WordPress installs, and custom container images should confirm their branch and rebuild any pinned images.

Cloudflare WAF rules buy time, not a fix

Cloudflare says it deployed two new WAF rules at 17:03 UTC on July 17, 2026. One targets the SQL injection path, and one targets requests associated with remote code execution. Both have a default action of Block.

Cloudflare Pro, Business, and Enterprise customers should check that Managed Rules are enabled and that ruleset-level overrides did not switch the new rules from Block to Log. Free-plan customers are covered through the Cloudflare Free Ruleset when WordPress traffic is proxied through Cloudflare's WAF.

For incident review, look in Security Events for matches on the new rule IDs and inspect requests to the affected REST API path. Treat matches as exposure signals, then verify whether the origin was patched before the traffic arrived.

Immediate checklist for site owners

• Confirm WordPress is running 7.0.2, 6.9.5, 6.8.6, or 7.1 beta2 depending on branch.
• Check managed-hosting dashboards and CI images, not only the WordPress admin screen.
• If behind Cloudflare, confirm the new WAF rules use Block and inspect Security Events.
• Review admin accounts, recent plugin/theme changes, and server logs if suspicious requests appear.

Security teams maintaining AI-generated sites, client landing pages, or automation-managed WordPress installs should add this to their normal patch inventory. LinkLoot's automation guide at /guides/ai-workflow-automation is useful only after the baseline is secure: first patch, then automate checks so this class of update is visible next time.

Evidence

The primary source is the official WordPress 7.0.2 release note. Cloudflare provides mitigation details and WAF rule behavior, while Rapid7 supplies independent security-analysis context for CVE-2026-63030. This post avoids exploit steps and focuses on patching, version checks, and defensive validation.