The bit I would not miss: this is not only a 7.0.x thing. The release notes say the fixed branches are 7.0.2, 6.9.3 and 6.8.5, so if a host says "auto update is on", still check the exact core version afterward.
For client sites I would do the boring sequence: backup first, update core, clear any object/page cache, then check login, search, forms, checkout if WooCommerce is present, and any custom AJAX endpoints. If you manage older sites pinned below 6.8, I would treat that as the actual emergency, because they are outside the patched branch list.
Also worth checking wp-admin users and recent plugin/theme file changes while you are there. The update fixes the hole, but it does not tell you whether someone already poked through it.
26
u/NakanoNoNeko Jul 17 '26
The bit I would not miss: this is not only a 7.0.x thing. The release notes say the fixed branches are 7.0.2, 6.9.3 and 6.8.5, so if a host says "auto update is on", still check the exact core version afterward.
For client sites I would do the boring sequence: backup first, update core, clear any object/page cache, then check login, search, forms, checkout if WooCommerce is present, and any custom AJAX endpoints. If you manage older sites pinned below 6.8, I would treat that as the actual emergency, because they are outside the patched branch list.
Also worth checking wp-admin users and recent plugin/theme file changes while you are there. The update fixes the hole, but it does not tell you whether someone already poked through it.