WordPress 7.0.4 Patches a High-Severity RCE Flaw: What Hosted Sites Should Do Right Now
WordPress 7.0.4 is out, and unlike routine maintenance releases, this one carries a security fix that the project recommends applying immediately. The underlying issue is tracked as CVE-2026-65640, rated 8.8 on the CVSS scale — high severity — and described as a remote code execution flaw affecting WordPress core versions from 4.7 all the way up to 7.0. That version range matters: it means virtually every unpatched WordPress installation on the internet, on shared hosting, VPS, or dedicated servers alike, falls within the affected scope. For site owners, agencies managing client fleets, and hosts running thousands of installs, the response should be less "add it to next sprint" and more "patch today." In this piece we break down what is confirmed, what is still unclear, how to roll the update out efficiently across different hosting setups, and which hardening steps deserve attention alongside the patch. For a more detailed walkthrough of this part of the topic, r...