07/08/2026
WordPress shipped 7.0.3 yesterday, a security release covering 12 fixes. The one worth knowing is the login screen flaw, CVE-2026-64638, rated 8.9, high severity. You don't need to be logged in for it to be reachable, but it only actually fires if an admin clicks a crafted link. Click it, and it can lead to PHP code ex*****on, full control of the site.
Then there's WP2Shell, CVE-2026-63030 chained with CVE-2026-60137, patched back on 17 July. This one's worse in a different way. It takes over an unpatched site with a single unauthenticated request, nothing needs clicking or logging in. It hits WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1, and three weeks after the patch went out it's still spreading, purely because sites never updated.
Both are closed by the same simple action. Back up your site, then update to 7.0.3.
Neither of these flaws exists because of AI. What's changed is the pace: WP2Shell going from patch to still-spreading-three-weeks-later is happening because exploitation now moves faster than a lot of site owners update. That's the real story here, not some AI apocalypse, just speed!!
Worth knowing this isn't a WordPress-only story either. Several major Linux distributions have had unusually large security releases over the same few weeks..
I'll say where I sit on this, since it's relevant. I use AI daily in my own work, research, drafting, catching patterns faster across client sites. I'm not against it. But I don't let it make the call on anything security-related without checking it myself first. That's not me being precious about it, it's just how you avoid swapping one blind spot for another. The tools help. Staying on top of what's actually happening on a site is still the job.
I'll go deeper on the AI side of this soon, whether it's actually changing the security picture for WordPress or just speeding up a fight that was already happening.
For now though - if you aren't supported by a developer or have a maintenance plan and you have a Wordpress website - go check your version number an go patch.
-Kelly. DuckSoupDigital.co.uk
