If your website runs WordPress, update it this week

Published 2026-07-19 by Woodruff Training

WordPress runs a large slice of the world's websites, so there is a good chance this affects you. In mid-July 2026, WordPress released an urgent update after researchers found a flaw serious enough that an attacker could take over a website without ever logging in. By the time the fix appeared, criminals were already using it. The good news is that the fix itself is simple. Update WordPress, and the door closes.

What actually happened

WordPress powers a huge share of the world's sites, plenty of them small business ones, from the local plumber to the village shop. The flaw, patched in WordPress version 7.0.2 on 17 July, let an attacker with no password and no account run their own code on a vulnerable site. In plain terms, a stranger could hijack the site: deface it, plant scam pages, redirect your customers, or quietly use it to send spam in your name.

The United States cyber agency added the flaw to its list of bugs being actively exploited. That is as clear a signal as you get to patch now rather than later.

What to do

If someone else looks after your website, send them one line: "Please confirm we are on WordPress 7.0.2 or later." That is the whole job.

If you manage it yourself:

• Log in to your WordPress dashboard and update to the latest version (7.0.2 or newer) today.
• Update your plugins and themes while you are there. Out-of-date plugins are the other common way in.
• Turn on automatic updates for WordPress itself, so the next urgent fix installs on its own.
• Take a fresh backup before you start, and keep taking them regularly.

Why this keeps happening

Websites are software, and software gets flaws. That is normal, and not a reason to panic. What matters is how fast you apply the fixes. A site that updates promptly is a hard target. A site still running last year's version is the one attackers go looking for.

If keeping your site patched and backed up is one more job you never quite get to, we can set it up to look after itself. Ask us to take a look at your current setup.