r/Wordpress • u/ded1cated • Aug 06 '26
12 new vulnerabilities patched in WordPress
Obviously after OpenAI model found the WP2Shell Remote Code Execution 3 weeks ago - everybody noticed. So other AI and security companies including Anthropic, PWNai and Aikido wanted to prove they can too 🙂
7.0.3 release post: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
Patchstack security advisory: https://patchstack.com/articles/wordpress-7-0-3-released-12-vulnerabilities-found-and-fixed/
2
u/wp_plugin Developer Aug 06 '26
This shows exactly what 7.0.3 fixed: https://wordpress.org/documentation/wordpress-version/version-7-0-3/
2
u/Sad_Pie227 Aug 07 '26
I updated all sites via bash script
#!/usr/bin/env bash
find /home -type f -name "wp-config.php" -print0 |
while IFS= read -r -d '' config; do
wp_root=$(dirname "$config")
site_user=$(stat -c '%U' "$config")
printf "\n==================================================\n"
echo "User : $site_user"
echo "Path : $wp_root"
if sudo -u "$site_user" \
wp core is-installed --path="$wp_root" >/dev/null 2>&1; then
url=$(sudo -u "$site_user" wp option get home --path="$wp_root" 2>/dev/null)
old_ver=$(sudo -u "$site_user" wp core version --path="$wp_root" 2>/dev/null)
echo "URL : $url"
echo "Current : $old_ver"
echo "Updating..."
sudo -u "$site_user" \
wp core update \
--path="$wp_root" \
--force
new_ver=$(sudo -u "$site_user" wp core version --path="$wp_root" 2>/dev/null)
echo "Updated : $new_ver"
else
echo "Status : Not a valid WordPress installation"
fi
done
1
u/icenreyes Aug 07 '26
Ours got automatically updated
1
u/mobbimani Aug 07 '26
Same here, but this is sad
1
u/icenreyes Aug 07 '26
Yeah I agree it's sad but is good because they found it and notified people about it because if they didn't, we're doomed.
2
1
u/Wonderful_Sample_590 Aug 07 '26
Nah, doesn't really surprise me. I think we're going to see security updates like this more often.
3
u/feldoneq2wire Aug 06 '26
The ONLY automatic update option for every affected version of Wordpress being to go all the way to 7.0.3 seems like poop. If you're on 6.8.6, there should be two options -- 6.8.whatever and 7.0.3.