If you run your own site, the ground shifted twice this summer and you probably only felt it once. In May, WordPress rebuilt its foundation to run artificial intelligence. In July, it shipped an emergency fix for a hole big enough to hand a stranger the keys to your server. Same platform, seven weeks apart. One change got a keynote. The other got a forced update you may have slept through.
Here is the short version for anyone who does not keep a developer on retainer. WordPress 7.0 arrived on May 20 and moved AI tooling straight into the core software instead of leaving it to plugins. Then on July 17 the project pushed a rare out-of-band patch that closed two nasty flaws. If your dashboard says you are current, you already lived through the frightening part. If it does not, go check before you read another paragraph.
Confirm the patch before you do anything else
The WordPress 7.0.2 security release was not routine housekeeping. It fixed two vulnerabilities, and the worse of the pair, tracked as CVE-2026-63030, was a remote code execution vulnerability hiding in the REST API. Security researchers nicknamed the exploit chain wp2shell, which tells you exactly what it did. An unauthenticated attacker could confuse the API into running their code on your site. The second bug, CVE-2026-60137, opened the door to SQL injection. The release notes put it plainly: it "addresses one critical and one high severity security issue."
Because the risk was that severe, WordPress.org did something it almost never does. It force enabled WordPress auto-updates for affected installs and backported the fix to older branches, landing patched builds at 6.9.5 and 6.8.6 for people who have not moved to the 7.x line yet. Sites older than 6.8 were not affected. The practical takeaway is boring and important. Open your dashboard, look at your version number, and make sure it reads 7.0.2 or newer, or 6.9.5 if you are holding on the previous branch. If it does not, update by hand right now, and if you have ever disabled automatic updates because one broke a plugin two years ago, this is the week to turn them back on. When a site does go sideways after an update, our panic mode recovery guide walks through the fastest way to get back online without losing your work.
Why does an out of band release matter so much? Most WordPress updates arrive on a predictable schedule, which gives you time to test them against your theme and plugins. An emergency patch skips that calendar because the alternative is worse. Within days of the fix going public, security firms published working exploit code and warned that attackers were already scanning for sites that had not updated. That is the pattern with any flaw this serious. The window between disclosure and mass exploitation is short, sometimes a matter of hours, and unattended sites are the ones that get caught. Checking your version number is the single highest value thing you can do this week, and it takes about thirty seconds from the Updates screen.
AI moved into the engine room
The 7.0 release is the bigger story once the fire is out. For years the way to add AI to a WordPress site was to bolt on a plugin and hope it played nicely. That era is ending. The new version put AI in WordPress core as a set of building blocks that plugins and themes are meant to share. There is an AI Client for talking to language models, a Connectors Hub that lets you authorize an AI provider with a click instead of pasting API keys into a settings box, and a PHP AI SDK so developers stop reinventing the same wheel.
The piece worth understanding is the Abilities API. It gives every plugin a standard way to describe what it can do, so an AI agent can discover those capabilities and use them without a human clicking through menus. Think of it as a common language between your software and the machines now reading it. The tradeoff for all this is a raised floor. WordPress 7.0 requires PHP 7.4 at minimum, which is old news for most decent hosts but a reason to confirm your plan supports it. If you walked through the changes in our breakdown of WordPress 6.9, this is the sequel that actually rewrites the rules.
What the Model Context Protocol means for a one-person site
One acronym in the 7.0 notes deserves attention because it changes who, and what, can touch your website. WordPress now ships an official adapter for the Model Context Protocol, the emerging standard that lets AI agents read and write to a system directly. In plain terms, tools like Cursor, Claude Code, and Codex can now connect to a WordPress install and edit it the way a contractor would, drafting posts, adjusting settings, fixing markup, all through an agent rather than the classic dashboard.
For a solo operator this cuts both ways. The upside is obvious. Tedious jobs that used to eat an afternoon can be handed to an agent that works while you do something else. The caution is just as real. An interface built for automated write access is an interface worth guarding. Use strong application passwords, give any agent the narrowest permissions it needs, and keep a recent backup, because the same door that lets a helpful agent in is the kind of door attackers probe first. None of this is a reason to avoid the feature. It is a reason to treat access like the valuable thing it now is.
WordPress 7.1 is already at the door
If 7.0 felt like a lot, brace yourself, because WordPress 7.1 is scheduled for August 19, with Beta 3 having gone out on July 22. It is a smaller, friendlier update. The headline addition is an "Apply globally" review step, a confirmation prompt before a style change ripples across your whole site, which is the kind of guardrail that saves DIY owners from their own fat fingers. There are overdue media fixes too, including better handling of animated GIFs, EXIF rotation so phone photos stop landing sideways, and cleaner uploads from Safari. Nothing here demands panic. It is simply the next step, arriving fast.
Your move this week
Strip away the version numbers and the plan is short. First, confirm you are patched, because a remote code execution flaw that ships with a working exploit is not a maybe. Second, leave automatic updates on, since the project just proved it will use them to protect you in an emergency. Third, check that your host runs PHP 7.4 or higher so you can actually take the new releases. Fourth, decide on purpose whether you want AI features switched on, rather than discovering later that a plugin quietly wired an agent into your site.
Good WordPress maintenance used to mean updating plugins and clearing a cache. It now means paying attention to who and what can write to your site, and to a platform that is changing faster than it has in a decade. The tools are genuinely useful. The security stakes are higher than they were in the spring. Both things are true, and a webmaster who takes twenty minutes this week to get current is in a far better spot than one who finds out the hard way. Check your version number. Then go build something.
