The WordPress on AWS by FOSSonCloud pattern now ships WordPress 7.0.2, up from 6.9.4. That’s a full major version plus two patch releases — and the second of those patches is an urgent security release you should not wait on.
If you take one thing from this post: get to 7.0.2. It patches a critical remote-code-execution vulnerability that is real and actively relevant, not theoretical.
What changed
WordPress 7.0 “Armstrong” — the biggest core release in years
Released May 20, 2026 and built by 875+ contributors (200+ of them first-timers), 7.0 touches four areas:
- AI integration in Core. A new, provider-agnostic AI Client and Abilities API let WordPress talk to generative AI models — Anthropic, Google, OpenAI, or a custom provider — managed through a new central Connectors screen in the dashboard. Importantly, 7.0 ships this plumbing without turning on any active AI features by default. It’s infrastructure for future releases and plugins to build on.
- A modernized admin dashboard. Refreshed color scheme, smoother view transitions between admin screens, and a new Cmd+K / Ctrl+K command palette available from anywhere in the admin.
- New editor and design tools, including Visual Revisions — a genuinely useful visual way to compare and scrub through post revisions — and a Suggestions mode for Notes.
- Developer APIs, including server-side block registration improvements.
One notable absence: real-time collaborative editing (Google Docs–style multi-user editing) was the headline feature going into this cycle, but it was pulled twelve days before launch and postponed to a future version. If you were planning around it, it isn’t here.
7.0.1 — routine maintenance
31 bug fixes across Core and the Block Editor.
7.0.2 — the urgent one
Released July 17, 2026, patching one critical and one high-severity vulnerability:
- A REST API batch-route confusion issue that could lead to remote code execution
- A SQL injection issue
Together the researchers who reported them nicknamed the pair “wp2shell.” The severity was high enough that WordPress.org enabled forced automatic updates for affected sites and backported the fix to the 6.8 and 6.9 branches as well.
Why it matters
The 7.0.2 vulnerabilities are the part that demands attention today. A REST API path to remote code execution on a public-facing CMS is about as serious as it gets — an attacker who reaches it owns the instance, not just the content. The fact that WordPress.org took the unusual step of force-pushing automatic updates tells you how they weighted it internally.
Everything else in 7.0 is upside rather than urgency. The AI Client is the most strategically interesting piece: instead of every AI plugin shipping its own provider integration and its own credential storage, Core now owns that layer, and you configure providers once in Connectors. If you’re planning AI-assisted editorial workflows, that’s a much better foundation than the plugin-by-plugin sprawl that came before it. But nothing happens by default — you or a plugin have to actually connect a provider.
The admin refresh is the change your editors will notice first, and the command palette is a real productivity gain for anyone who lives in wp-admin.
What you should do
- Update to at least 7.0.2 immediately if you haven’t already. This is the one action item that can’t wait. Fresh deployments from the pattern are already on 7.0.2.
- Check your backups before the major-version jump. Going from 6.9.x to 7.0.x is a major upgrade — take a snapshot first.
- Audit your plugins and theme against 7.0 in a staging environment before promoting. Major WordPress releases are usually gentle on compatibility, but the block editor and server-side block registration changes are worth a pass if you maintain custom blocks.
- Decide your AI posture deliberately. The Connectors screen is new surface area in your admin. If you don’t intend to use AI features, connect nothing and leave it alone — nothing activates on its own. If you do, decide which provider and who can configure it before someone else does.
- Tell your editors about the admin changes — the new color scheme, the transitions, and especially Cmd+K. A one-paragraph heads-up prevents a week of “did something break?” tickets.
Version details in this post come from WordPress’s own release notes and security advisories. If you hit anything upgrading the pattern, open an issue on GitHub.
— FOSSonCloud