Wordpress 7.0.2 security patch

bikegremlin · July 18

An anonymous HTTP request can run code on a WordPress site.

ASAP update is advised to patch this WP core vulnerability:

Affected versions 6.9 (patched with 6.9.5 update) and 7.0 (patched with 7.0.2 update)

Article on the topic:
https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html

somik · July 18

Keep autoupdate on wordpress enabled. Lifesaver for issues like this.

As for me, I switched from wordpress to static file hosting so that is another great alternative if your site content does not change often.

mikho · July 18

@somik said:
Keep autoupdate on wordpress enabled. Lifesaver for issues like this.

As for me, I switched from wordpress to static file hosting so that is another great alternative if your site content does not change often.

This.

I'm in the process of changing to a static site.
Still tweaking the looks, but its close to removing Wordpress and one headache less.

bikegremlin · July 18

Static sucks for changes and rewrites/updates. A dynamic CMS was invented for a reason.

Auto updates also come with site breaking risks.

Pros and cons.

somik · July 18

@bikegremlin said:
Static sucks for changes and rewrites/updates. A dynamic CMS was invented for a reason.

CI-CD was also invented for this. My entire site is written in markdown for easy edits and changes. Once I "commit" my changes to git, the "static" site is generated and my server get's a trigger to "pull" the changes and deploy it.

somik · July 18

@mikho said:

@somik said:
Keep autoupdate on wordpress enabled. Lifesaver for issues like this.

As for me, I switched from wordpress to static file hosting so that is another great alternative if your site content does not change often.

This.

I'm in the process of changing to a static site.
Still tweaking the looks, but its close to removing Wordpress and one headache less.

Good on you!

I can assure you the decision is not easy, but once you manage to finally switch out your wordpress with a static site, you wont look back.

Wordpress is too much bloat for most sites and blogs. It's too "generic" for most people cause it tried to do EVERYTHING while being good at nothing...

mikho · July 18

@somik said:

@bikegremlin said:
Static sucks for changes and rewrites/updates. A dynamic CMS was invented for a reason.

CI-CD was also invented for this. My entire site is written in markdown for easy edits and changes. Once I "commit" my changes to git, the "static" site is generated and my server get's a trigger to "pull" the changes and deploy it.

this is the process I'm working by.
Local site editing in Obsidian (not sure why, but I have lots of notes in there), connected with Claude Code.
I edit, ask Claude to push it and have a webhook that pulls the updated files to my live website

At least, that is what the finished product will be

somik · July 18

@mikho said:

@somik said:

@bikegremlin said:
Static sucks for changes and rewrites/updates. A dynamic CMS was invented for a reason.

CI-CD was also invented for this. My entire site is written in markdown for easy edits and changes. Once I "commit" my changes to git, the "static" site is generated and my server get's a trigger to "pull" the changes and deploy it.

this is the process I'm working by.
Local site editing in Obsidian (not sure why, but I have lots of notes in there), connected with Claude Code.
I edit, ask Claude to push it and have a webhook that pulls the updated files to my live website

At least, that is what the finished product will be

I am using github + mkdocs. The workflow (and my site source code) is here:
https://github.com/somik123/site/blob/main/.github/workflows/deploy.yml

vyas · July 18

I bit the bullet and moved mysite from (Classic)Wordpress to static. Worked long hours with chatgpt and Mistralai to literally create it from scratch- to suit my needs. Was fun at times, frustrating most of the time and fabulous learning experience overall. Tried six or seven "static" cms..but settled for what I did. One was from your homeland- Datenstrom. Good bones, nice and easy.

rsync.. bliss !

@mikho said:

@somik said:
Keep autoupdate on wordpress enabled. Lifesaver for issues like this.

As for me, I switched from wordpress to static file hosting so that is another great alternative if your site content does not change often.

This.

I'm in the process of changing to a static site.
Still tweaking the looks, but its close to removing Wordpress and one headache less.

vyas · July 18

@bikegremlin said:
Static sucks for changes and rewrites/updates. A dynamic CMS was invented for a reason.

Auto updates also come with site breaking risks.

Pros and cons.

Yes, "Handover of maintenance" to an intern is a pro ;-) j/k. But i know what you mean...

@somik said:

I am using github + mkdocs. The workflow (and my site source code) is here:
https://github.com/somik123/site/blob/main/.github/workflows/deploy.yml

Chatgpt kept sneaking in git for my discussions. I had to keep reminding it- I do not need git. Had to finally add "If you add git again, you will have to sing a song."

mikho · July 18

@vyas said:
I bit the bullet and moved mysite from (Classic)Wordpress to static. Worked long hours with chatgpt and Mistralai to literally create it from scratch- to suit my needs. Was fun at times, frustrating most of the time and fabulous learning experience overall. Tried six or seven "static" cms..but settled for what I did. One was from your homeland- Datenstrom. Good bones, nice and easy.

rsync.. bliss !

@mikho said:

@somik said:
Keep autoupdate on wordpress enabled. Lifesaver for issues like this.

As for me, I switched from wordpress to static file hosting so that is another great alternative if your site content does not change often.

This.

I'm in the process of changing to a static site.
Still tweaking the looks, but its close to removing Wordpress and one headache less.

I considered using Datenstrom but went with grav instead.

Same idea as with Datenstrom, keeping it simple and clean.

I still have a couple of ”theme” tweaks before I go live and replace my old website.

One thing I did was to try out using claude to re-write some of my ideas to proper articles.

It still needs a couple of more manual edits to have Claude learn how I write.
It look promising though.

All I want is an easy way to write notes and ”automagically” a short article is posted.

vyas · July 18

@mikho said:
All I want is an easy way to write notes and ”automagically” a short article is posted.

The Holy Grail. I am a thousand mile away from the destination (i.e. I have taken the first step :-) )

p.s: The "blog" link in my signature is the wip static site perinneally under "development" while content gets updates.

MichaelCee · July 18

Also switched to static. All of my blog/news pages are just whatever website with an easy copy and paste template for new content. Much less of a headache

mikho · July 18

@vyas said:

@mikho said:
All I want is an easy way to write notes and ”automagically” a short article is posted.

The Holy Grail. I am a thousand mile away from the destination (i.e. I have taken the first step :-) )

p.s: The "blog" link in my signature is the wip static site perinneally under "development" while content gets updates.

I'm almost there; the text is not "in my own words," so to speak, but the gist is there. I have 10 articles that I will rewrite when I finish another coding project (just for fun). I hope it will learn, eventually

imok · July 18

Thanks. I'm still using WP in nearly 10 sites.
The ones never hacked are the ones with templates made from scratch by me (and well-maintained plugins) . I mean, not using things made for widely general purposes.

somik · July 19

@imok said:
Thanks. I'm still using WP in nearly 10 sites.
The ones never hacked are the ones with templates made from scratch by me (and well-maintained plugins) . I mean, not using things made for widely general purposes.

This is what you should do IF you want to reduce risks while still using wordpress. Wordpress itself is usually has low risks, unlike the themes and plugins which is the most usual way to get hacked. I would recommend keeping some logs or security plugin that shows what is going on with your wordpress site, like file changes and login attempts.

Also bots target wordpress login page heavily so it's recommended to protect the login with cloudflare bot protection. My wife is still using wordpress and her login page is protected by a cloudflare's "i'm under attack" mode to reduce the password bruteforce attacks...

mikho · July 19

Generally speaking, is there an open-source WordPress dashboard where you can add the sites you manage and see their status and updates needed?

I mean, I manage 4 WP sites, and I think it takes a lot of my time to log in and update each site manually.
What if you have 10+ sites, or even 50+ sites?
With all these updates for plugins and themes coming almost every day now, something like that would be useful, wouldn't it?

I might take that up as a project to vibe-code Open source, of course.

vyas · July 19

MainWP ?

bikegremlin · July 19

@mikho said:
Generally speaking, is there an open-source WordPress dashboard where you can add the sites you manage and see their status and updates needed?

I mean, I manage 4 WP sites, and I think it takes a lot of my time to log in and update each site manually.
What if you have 10+ sites, or even 50+ sites?
With all these updates for plugins and themes coming almost every day now, something like that would be useful, wouldn't it?

I might take that up as a project to vibe-code Open source, of course.

Self-hosted Infinite WP is not too bad (free).

mikho · July 19

@vyas @bikegremlin

Thanks. I’ll save my Tokens then.

Wolveix · July 19

@mikho said:
Generally speaking, is there an open-source WordPress dashboard where you can add the sites you manage and see their status and updates needed?

I mean, I manage 4 WP sites, and I think it takes a lot of my time to log in and update each site manually.
What if you have 10+ sites, or even 50+ sites?
With all these updates for plugins and themes coming almost every day now, something like that would be useful, wouldn't it?

I might take that up as a project to vibe-code Open source, of course.

I manage a few hundred WP sites. Automatic updates manage a lot, but MainWP covers the rest. I'll be replacing MainWP soon since it's kinda rubbish when you have more than 50+ sites (or it's a skill issue on my part), and because we've integrated all of the functionality we needed into our own control panel. But it's solid and straightforward to setup on your sites

WSS · 4:08PM

I hate WordPress with every fiber of my being.

Wordpress 7.0.2 security patch

Comments