148. Urgent Update for 6.8, 6.9, and 7.0

A security release has been published for versions 6.8, 6.9, 7.0, and 7.1-beta that fixes 2 critical security issues in WordPress core.

Program transcript

Hello, I’m Alicia Ireland, and you’re listening to WPpodcast, bringing the weekly news from the WordPress Community.

In this episode, you’ll find the information from July 13 to 19, 2026.

This week’s major news is security-related, and it’s serious. WordPress has released version 7.0.2, an emergency release that fixes two vulnerabilities: one critical and one high severity. The critical one, already known in the community as “wp2shell” and cataloged as CVE-2026-63030, allows an unauthenticated attacker to execute code through the REST API’s batch endpoint without needing an account or user interaction, against a standard installation with no plugins. It’s combined, furthermore, with an SQL injection flaw identified as CVE-2026-60137, forming a complete exploitation chain.

Given the severity, the WordPress.org team has activated forced updates through the auto-update system for affected sites, so many sites will have updated themselves already. Still, it’s worth checking manually: go to the dashboard, to “Updates,” and force “Update Now” if needed. Affected versions have also received retroactive patches: 6.9 moves to 6.9.5, fixing both flaws, and 6.8 moves to 6.8.6, fixing only the SQL injection issue. The 7.1 beta has also been updated, to beta 2, with both fixes. Versions earlier than 6.8 are not affected.

So far there are no confirmed public exploits or evidence of active exploitation, but several researchers warn that, with WordPress being an open source project, it’s only a matter of time before a public proof of concept appears.

We have WordPress 7.1 Beta 1 on the table, with final release scheduled for August 19. It’s a feature-packed release that finally brings core a good batch of functions that have been cooking in the Gutenberg plugin for a while. Notes become a much more serious collaboration tool: they support inline text formatting, at-mentions, multiple independent threads on the same block, and notes anchored to a specific text selection rather than to the entire block. On the design front, true responsive styling arrives within the editor — like defining how a block looks on tablet or mobile without touching a line of CSS, customizable breakpoints from theme.json, and styling of interactive states like hover or focus, both globally and per individual block instance.

The media experience also takes a leap: image processing moves to the browser, with expanded support for HEIC, AVIF, UltraHDR, and GIF to video conversion, more resilient uploads with automatic retries, and a new image editing modal that brings cropping, rotation, and metadata into one place. Galleries get smarter, automatically pulling already-attached images from the post. And as for new blocks, the Playlist block arrives, with audio player and waveform visualization, and the Tabs block for organizing content into tabs — both without needing third-party plugins.

The other major change in this version is navigation: the admin toolbar now stays with you at all times, both in the post editor and in the Site Editor — something that previously disappeared in the latter. The WordPress logo icon, which until now confusingly served as a back button, is replaced by a dedicated button shaped like an arrow; the logo always opens the About page, and the site icon, when it exists, opens the site menu. If you develop plugins that add nodes to this bar, it’s worth reviewing that they still work well in the Site Editor, since that persistent mode didn’t exist there before.

For block developers, this is the version to pay close attention to. Starting with 7.1, the post editor’s canvas always renders inside an iframe, on any theme and regardless of the apiVersion declared in blocks. Until now, just having a single block active in apiVersion 2 or lower on the post was enough to pull the entire editor out of the iframe; that behavior completely disappears in 7.1. The advantage is real: admin styles no longer bleed into the content, and units like vw or vh and media queries finally resolve against the canvas itself, not the admin page, so tablet and mobile preview views actually behave like the frontend.

As always each cycle, the Test team is asking for active help: you don’t need to be a professional QA, just use WordPress as you normally would in a test environment and report what doesn’t line up. There are step-by-step guides for testing each new feature: Notes, responsive styling, interactive states, the persistent toolbar, the media modal, or dynamic galleries.

The Developer Blog has published a tutorial for setting up a maintenance page branded for each site, instead of the typical bland “briefly unavailable” message WordPress displays during updates. The clever part about the technique is how it distributes the work: the developer adds a single hook to the custom plugin functions file, just once, and from there on all management of the maintenance page — both design and activation — is handled from the Site Editor without touching code or files.

The hook looks for a template called exactly “Maintenance” in the database, and if it finds it, serves it to any unlogged visitor; anyone logged in sees the site normally, which is useful for reviewing changes during the update itself. There’s a slightly more elaborate variant that adds headers designed for search engines: a 503 “service unavailable” status code, a Retry-After suggesting they come back in an hour, and no-cache headers so the site serves without cache issues as soon as maintenance mode is turned off. Especially recommended if the site gets important search traffic or maintenance windows run long.

With the hook in place, creating the template is as simple as going to Appearance → Editor → Templates, adding a new one called “Maintenance,” and building it like any other template.

The Playground team has launched a call to test the new WordPress Playground interface before its official launch, and they’re seeking feedback on both desktop and mobile. You don’t need to test everything: they propose four independent testing blocks, from creating and managing playgrounds, going through the blueprint gallery, to tinkering with files, databases, and logs, or testing site import and export, including export to GitHub.

What’s interesting is that they’ve left a public testing environment that’s accessible without needing to install anything, and they’re asking you to pay attention to specific things: whether text and buttons are understandable, whether behavior is as expected, whether there are layout issues, and what you’d improve.

The Community team has presented Community Agents, a platform of AI assistants designed to lighten repetitive tasks: reviewing event organizer requests, checking WordCamp budgets, and auditing sites for GPL license or trademark issues.

The project is built on two principles: human in the loop — meaning the agent proposes but never auto-approves anything — and respect for privacy, since it only works with public information like WordPress.org profiles or links, without requesting personal data like emails or addresses.

A new addon for CampTix, the system that manages community events, has been presented to solve a classic WordCamp problem: how to manage limited-capacity activities like Contributor Day, the social dinner, or workshops, which until now were managed with parallel forms, hand-crossed spreadsheets, or just good judgment on the part of attendees. The addon, currently nicknamed “activity tickets,” lets organizers create these activities as normal CampTix tickets at zero price and mark them as activity tickets from the settings panel itself.

The addon is finished and tested locally, with over fifty automated tests and a complete test against a real WordCamp site, but it hasn’t been officially submitted yet. Before that, the team is asking the community for feedback, especially from anyone who’s ever organized a Contributor Day or another limited-capacity event.

And finally, this podcast is distributed under a Creative Commons license as a derivative version of the podcast in Spanish; you can find all the links for more information, and the podcast in other languages, at WPpodcast .org.

Thanks for listening, and until the next episode!