---
title: "Security digest: July 17, 2026"
url: https://erroneo.us/security/2026-07-17/
description: "July 17, 2026 vulnerability digest: 1 brief (WordPress 7.0.2: REST Batch + SQL Injection…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-17
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 17, 2026

1 editorial brief.

## Take stock

- Act now: WordPress 7.0.2: REST Batch + SQL Injection Chain to RCE . Anyone running WordPress 6.9.x before 6.9.5 or 7.0.x before 7.0.2 (RCE chain), or 6.8.x before 6.8.6 (SQL injection), especially with auto-updates disabled or blocked.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [WordPress 7.0.2: REST Batch + SQL Injection Chain to RCE](https://erroneo.us/security/briefs/wordpress-7-0-2-rest-batch-sqli-rce-cve-2026-63030/index.md): Core WordPress 6.9 and 7.0 sites were exposed to unauthenticated remote code execution that is now exploited; most sites got a forced update, so your job is to confirm every one actually did.

## Known exploited (CISA KEV)

None.

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2026-07-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt