Two CVEs in WordPress 6.8 and 6.9 were patched on 17 July 2026. One allows arbitrary code execution on your server — that is as serious as it sounds. If my sites were still on either version, updating to 7.0.2 would be the first thing I did this morning. Both CVEs are publicly logged, meaning unpatched sites are visible targets. #WordPress #WordPressSecurity #CVE #WebSecurity #WPSecurity https://wpguy.uk/blog/wordpress-security-flaw-what-business-owners-must-do-right-now/