Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
7.0.7
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 7.0.7 Released

WordPress 7.0.7 is now available as a maintenance release in the 7.0 series, with the project recommending PHP 7.4.

Maintenance release in the 7.0 series Recommended PHP 7.4
AI summary

WordPress.org has published version 7.0.7 of WordPress core, a maintenance update in the 7.0 series. Site owners and administrators running WordPress should be aware of this release as part of keeping their installations current. The release notes point to PHP 7.4 as the recommended PHP version for this release.

What's in this release

According to WordPress.org, version 7.0.7 is now available for download, and the recommended PHP version for running it is PHP 7.4. No further specifics about individual fixes or changes were provided in the release listing beyond the version number itself. As with other point releases in a core version series, updates of this kind typically consist of maintenance work rather than major new functionality.

Upgrade notes

Most WordPress sites with automatic background updates enabled for minor releases will receive 7.0.7 without any manual action required. Site owners who manage updates manually, or who run WordPress on managed hosting with update controls, should plan to update through the Dashboard's Updates screen or via WP-CLI (wp core update) at their next convenient maintenance window. Before updating, it's good practice to take a full backup and confirm that your hosting environment meets the recommended PHP 7.4 baseline, since running an unsupported or outdated PHP version can affect compatibility and performance.

Compatibility considerations

The recommendation of PHP 7.4 aligns with WordPress's general guidance that sites run a currently supported PHP version for better security and performance; however, site owners should also check their specific theme and plugin requirements, since some may require newer PHP releases. If your hosting plan already runs a more recent PHP version, there is no need to downgrade — PHP 7.4 represents the minimum recommended baseline mentioned for this release, not a required target.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email