WordPress 7.0.1 on July 9 plus three critical plugin vulnerabilities: what SME websites must check this week

On Thursday, July 9, 2026, WordPress releases version 7.0.1. The release candidate has been available since July 1. We installed it in our staging environment and worked through the changelog. In short: 7.0.1 is a pure bug-fix release. It ships no security-relevant patches.

That matters. In parallel, three critical plugin vulnerabilities were disclosed in the first week of July, and they are far more serious than the core update itself. Anyone who installs 7.0.1 and ignores the rest has done less than half the job.

What WordPress 7.0.1 actually fixes

The core developers' release plan is public. 7.0.1 collects regressions from the 7.0 cycle: bugs introduced by the switch to Armstrong. Not a single ticket is flagged as a security vulnerability.

Examples from the list:

• Missing aria-label on the lightbox button for single images
• Navigation: restoring a fallback function that was marked deprecated
• Editor: focus jump when switching into revision mode
• Fixing a black flash in the admin before hydration

Useful cleanup. But no reason to panic and open an emergency window. If you run WordPress 7.0 stably, you can install 7.0.1 in your regular maintenance window. Our recommendation: staging first, then production, with a backup between the two steps.

For sites still on 6.x that have put off the 7.0 jump, 7.0.1 changes nothing about the starting position. The PHP 7.4 minimum stays in place. Anyone on PHP 7.3 or older cannot update to 7.x.

The three plugin vulnerabilities that really matter this week

While many operators watch the core update, Patchstack has published three flaws in the past few days that make sites directly takeover-able. All three are already patchable.

1. Novalnet Payment Gateway for WooCommerce (CVSS 9.8)

On July 2, 2026, Patchstack disclosed CVE-2026-57677 in the Novalnet payment plugin for WooCommerce. Every version up to and including 12.10.3 is affected. The flaw lets attackers take over the entire store without prior authentication.

Novalnet is widespread in the DACH region. The payment provider is based in Munich and handles transactions for thousands of WooCommerce stores. If you use the plugin, update to the current version immediately. With a compromised store, it is not only about data loss. It is about transaction manipulation and rerouting customer payments.

Check for operators: search for "Novalnet" under Plugins, read the version, and if it is 12.10.3 or older, update at once. If the plugin is active, also check the server logs for the period since July 2. Unusual POST requests to the checkout endpoint are a warning sign.

2. UpdraftPlus (actively exploited)

CVE-2026-10795 affects the UpdraftPlus backup plugin in versions up to 1.26.4. The flaw is already being actively exploited. Version 1.26.5 closes it. UpdraftPlus runs on an estimated 3 million WordPress sites worldwide.

Active exploitation means there are known attacks in circulation. Not theoretical, but real. If you run a vulnerable version of UpdraftPlus, you very likely already have compromise attempts in your logs. An update next month is not enough. We recommend patching within 24 hours.

Extra check: if UpdraftPlus uses cloud storage as its backup target (Google Drive, Dropbox, S3), also check the access logs of that cloud account. A compromised backup plugin is the most direct path to a full data theft.

3. WP-BusinessDirectory (CVSS 9.1)

CVE-2026-6070 in the WP-BusinessDirectory plugin, version 4.0.1 and older, lets attackers without a login delete arbitrary files on the server. A public exploit is available. The affected endpoint is task=upload.remove with an insufficiently protected _filename parameter.

What that means in practice: an attacker can delete the central configuration file wp-config.php and render the site unusable. Or selectively remove images, PDFs, and invoices from the upload folder. This is not data theft, it is targeted sabotage.

If you use the plugin, update it. If no update is available, deactivate the plugin until the vendor ships one.

Why this pattern comes back every quarter

We see this picture regularly now. A small core update that gets plenty of attention. At the same time, three to five critical vulnerabilities run through the plugin ecosystem and slip through in daily operations. The reason lies in the distribution:

• Core updates come from a central team with a release cycle and press attention
• Plugin updates are spread across more than 60,000 authors and are tracked only by security newsletters
• Many SME operators deliberately switch off auto-updates for plugins to avoid compatibility problems

The consequence: the core is usually current. The plugins are not. That is exactly where attackers strike. The Patchstack Vulnerability Report has named plugins as the primary attack vector for years.

Since early 2026, we have recommended our clients a fixed Friday slot for plugin reviews. Duration: 45 minutes per site. Content: check the Patchstack feed, identify affected plugins, test updates in staging, roll out Friday afternoon. It is not rocket science. But it only falls away when no one is responsible for it.

What we do for clients this week

This week we are working through our active client list. The routine per site:

1. Export the plugin inventory (WP-CLI: wp plugin list --format=json)
2. Check it against the current Patchstack database (publicly available)
3. For each affected site: update in staging, regression test, then production
4. After July 9: pull in core 7.0.1 in the same window
5. Update the maintenance log

The time needed is about 30 minutes per site when nothing unusual comes up. With the three critical CVEs above, that quickly adds up to half a day of standby, because auto-update conflicts or cache problems can occur.

For operators without a dedicated maintenance partner

If you look after your WordPress site yourself, four steps can head off a lot this week:

1. In the admin under Plugins, check every installed plugin against its current version
2. Watch especially for Novalnet, UpdraftPlus, and WP-BusinessDirectory
3. Take a backup before every update (not just once a week)
4. After the core update on July 9, run a front-end check: homepage, most important landing page, contact form

If you have no staging environment, install updates at a time when rolling back is possible. Friday at 10 p.m. is a poor choice. Tuesday morning is better.

What TYPO3 operators need to know

For our TYPO3 clients, things stay calm. The last security release was 14.3.4 on June 16. No urgent update is pending right now. Anyone who patches regularly is on a clean footing.

The structural difference between the two systems shows clearly in weeks like this. TYPO3 pushes less functionality into external extensions, documents security bulletins centrally through the TYPO3 Security Team, and publishes them over a single channel. That lowers the update frequency for operators without lowering security.

Conclusion

WordPress 7.0.1 on July 9 is important, but not urgent. The three plugin vulnerabilities from the first week of July are urgent, but get less attention. That very distortion is what attackers exploit.

If you run a WordPress site, check the plugin list first this week and close active vulnerabilities. The core update follows in your normal rhythm. If you are unsure about your plugin inventory or how to prioritize: we will look at it together. Contact us at waterproof.agency/kontakt/.

• WordPress 7.0.1 Release Candidate, Make WordPress Core, July 1, 2026. make.wordpress.org
• CVE-2026-57677 (CVSS 9.8), Novalnet Payment Gateway for WooCommerce ≤ 12.10.3, July 2, 2026. nvd.nist.gov / Patchstack
• CVE-2026-10795, UpdraftPlus ≤ 1.26.4 (actively exploited), patch 1.26.5. nvd.nist.gov
• CVE-2026-6070 (CVSS 9.1), WP-BusinessDirectory ≤ 4.0.1, unauthenticated arbitrary file deletion. cert.ug