WordPress News Roundup July 2026: wp2shell Forces WordPress 7.0.2 as WordPress 7.1 Enters Beta

July 2026 will be remembered for wp2shell. On July 17, WordPress 7.0.2 fixed a chain of two vulnerabilities that together allowed unauthenticated remote code execution on default installs, and WordPress.org took the rare step of forcing the update onto affected sites. Public exploits appeared within a day, making it the most serious core security event in nearly a decade.

At the same time, WordPress 7.1 moved through four betas on its way to WordCamp US, the Protect The Shire update hold was shortened, and the new review process proved its value when a backdoored plugin was caught and closed within hours.

Mergers, Acquisitions, and Investments

No significant WordPress acquisitions or investments were announced in July. The ecosystem’s attention stayed on security and the 7.1 cycle, while the motions to dismiss in WP Engine v. Automattic remained under submission with the court.

WordPress Core Updates

July brought two 7.0 point releases and the full beta phase of WordPress 7.1.

• WordPress 7.0.1 (July 9): A short-cycle maintenance release with 31 fixes across core and the block editor, covering the editor, admin UI and media. Aaron Jorbin, Brian Haas, Carlos Bravo and Estela Rueda led it.
• WordPress 7.0.2 (July 17): A security release fixing one critical and one high-severity issue, with backports in 6.9.5 and 6.8.6. Forced updates were enabled through the auto-update system. John Blackbourn and Barry Abrahamson led it, with help from hosts and companies including Altis, Automattic, Bluehost, Cloudflare, GoDaddy, Hostinger and WP Engine.
• WordPress 7.1 Beta 1 (July 15): The first beta brought responsive styling controls, client-side media processing, an admin toolbar that stays visible in the editors, and new Playlist and Tabs blocks.
• Betas 3 and 4 (July 22 and 29): Beta 3 dropped Unicode email address support from 7.1, moving it to a community plugin so more people can test its compatibility, security and data handling. Beta 4 brought more than 110 further fixes and was the last beta before Release Candidate 1, scheduled for August 5.
• The Classic block stays: On July 7, the core team reversed June’s plan, and the Classic block will remain in the inserter in 7.1 with no change for users or developers.

Other WordPress News

• WordCamp US preparations: WordPress.org published its guide to WordCamp US 2026, which runs August 16–19 at the Phoenix Convention Center with Contributor Day, a Showcase Day and four tracks across two conference days. The 7.1 release is planned for the final day.
• Update hold shortened: The Protect The Shire cooldown, which had held new plugin and theme releases for about 24 hours since June, dropped to roughly six to seven hours on July 16, according to Patchstack’s measurements of the update API.
• 7.1 documentation push: Community sites, led by Gutenberg Times’ “Source of Truth” guide at the end of the month, began documenting 7.1’s responsive styling, media modal and new blocks ahead of the release candidate.

Security Alerts and Plugin Vulnerabilities

July was the month the security conversation moved from plugins to core.

• wp2shell (CVE-2026-63030 and CVE-2026-60137): Adam Kues of Assetnote / Searchlight Cyber reported a REST API batch-route confusion that, combined with a SQL injection, allowed remote code execution without logging in. The full chain affected WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1, through an endpoint enabled by default. Public exploits were reported on July 18, and security firms reported exploitation in the wild soon after. Wordfence called it the first critical unauthenticated core RCE in nearly a decade.
• Backdoor caught within hours: On July 28, Wordfence’s automated PRISM system flagged a backdoor added to Advanced Responsive Video Embedder, a plugin with about 20,000 active installs, less than two hours after the malicious code was committed. Tracked as CVE-2026-18072 (CVSS 9.8), it gave unauthenticated attackers administrator access. WordPress.org closed the plugin shortly after Wordfence’s alert, while the release was still in the update cooldown.
• Super Forms file upload: Wordfence disclosed a critical unauthenticated arbitrary file upload flaw in Super Forms on July 9, one day after the vendor shipped a fully patched version.

Industry Trends and Insights

• Forced updates proved their worth: The automatic background update system, in place since 2013, let WordPress.org push 7.0.2 and its backports to millions of sites before most owners had read the advisory. With working exploits public within a day, that speed mattered.
• The cooldown faces its first real test: The Advanced Responsive Video Embedder case showed the value of holding releases for review. Security firms also pointed out that the same hold delays fixes for already disclosed vulnerabilities, and the window was cut sharply in mid-July.
• Moving work to the browser: 7.1’s client-side media processing shifts image work from the server to the visitor’s browser, a meaningful change for shared hosting, where PHP memory limits and upload timeouts are common pain points.
• Feature cuts for safety: Pulling Unicode email support late in the cycle, so it can mature as a plugin, shows the project is willing to hold back features that touch security and data handling.

Theme of the Month: Ollie

Ollie, the free block theme from Mike McAlister, is built entirely around the Site Editor, global styles and patterns. With 7.1’s betas introducing responsive styling controls and theme-defined breakpoints, a pattern-heavy block theme like Ollie is a practical place for site builders to test how the new controls behave on real layouts.

Plugin of the Month: Gutenberg

The Gutenberg plugin is where every 7.1 feature took shape before landing in the betas, from the Tabs and Playlist blocks to responsive styling and the new media editor. For developers and agencies, running it on a staging site in July was the easiest way to prepare client projects for August.

Host of the Month: Hostinger

Hostinger was among the hosting companies credited for helping coordinate the WordPress 7.0.2 security release, and it is one of the five Global Partners funding the 2026 WordPress event season. Host involvement in coordinated disclosure is a big part of why the wp2shell fix reached so many sites so quickly.

Founder of the Month: Mark Maunder

Mark Maunder founded Wordfence, and July showed how far its research operation has come. Its PRISM system caught the Advanced Responsive Video Embedder backdoor within two hours, and its team published some of the most detailed analysis of wp2shell and the attacks that followed.

Looking Ahead to August 2026

WordPress 7.1 Release Candidate 1 is due on August 5, with the final release planned for August 19 at WordCamp US in Phoenix, which runs from August 16 to 19. Expect more scrutiny of the Protect The Shire hold and how it treats security fixes, and continued exploitation of unpatched wp2shell targets. Site owners who rely on manual updates should confirm they are on 7.0.2 or a patched branch release.