On July 17, 2026, a critical security fix was released for WordPress. This post explains what the issue was, who it affected, and what’s being done about it – without getting too technical.
What Security Flaw?
Security researchers found two separate flaws in core WordPress. Neither one was catastrophic on its own. But when used together, they let an attacker send a single request to a website – without logging in – and have that request execute code on the server.
In plain terms: a stock, unmodified site with no plugins installed was still exposed. This wasn’t a plugin problem or a theme problem. It was in the foundation almost every site is built on.
How serious is this Core Security Issue?
Serious enough that the maintainers of the core software took the unusual step of forcing automatic updates onto every affected site that supported it, rather than waiting for site owners to update manually. That’s not standard practice – it’s reserved for issues where the risk of waiting outweighs the risk of an unexpected automatic change.
Public proof-of-concept code demonstrating the attack has already been circulating, and active exploitation attempts have been observed in the wild.
Who was affected?
Any site running a version of WordPress released over the past year, prior to the July 17 patch. Fixed versions were made available the same day.
Our (WPBarista) Response
Every site on our Growth-tier maintenance plan or above was patched automatically within our daily update cycle, and sits behind a firewall that adds further protection against exploitation attempts.
Sites on our hosting plans received the fix directly within 24 hrs.
Remaining sites on our Basic maintenance plan are being patched as part of this week’s scheduled maintenance window.
What you should do
If your site isn’t under an active maintenance plan with us, confirm your core software version through your dashboard and update immediately if you’re on an affected version. If you’re unsure how to check, ask your host or web developer for help. This should be done immediately.
New! Welcome-Email AI Agent
Looking at email marketing? Don’t forget a welcome series – folks are 4x more likely to open the first email than any other email that you send! Enter your email and we’ll send you to our custom AI Agent that will help you craft five highly converting emails in a welcome series! Then see this post for the tutorial.
Cathy Mitchell
Single Mom, Volunteer, Lifelong Learner, Jesus Follower, Founder and CEO at WPBarista.