Forced 7.0.2 Security Update

Rickey

7.0.2 was a security update and it showed up just while I was away for a week. Do you ever install the core WordPress updates (security-wise) automatically on client sites or is it always something that should be tested before sending it live to staging, first?

https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

anita.rath

By default, minor and security releases auto-install, unless a particular site has this disabled.

We don't restrict core minor versions - those stay automatic. And only major releases have to go through staging first. A security release like 7.0.2 is a minor so for us it just installs.

Do you gate majors behind staging too?

cristianlucaci

Because an auto-update once broke our checkout overnight and it was our client who pointed it out.

So we're manual with every update on our shops 😟

Mattia

Your update that caused the checkout break: was this a WordPress core minor version or an update to a plugin?

There's always this kind of blaming going on between WordPress core and plugins. For me as a developer, when there's a site update that breaks things, I always feel I'm going to find out that it was a core minor version. It was in fact a plugin.

cristianlucaci

This was a payment plugin updat not core.

I hadn't even checked which plugin it was and decided to switch all to manual.

aLLengoMEZ

You're correct that the 24-hour auto-update cooldown WordPress.org introduced in June applies to plugin and theme releases before auto-updates pick them up.

It doesn't extend to core security releases so those are handled differently from plugins and themes.

I hope that helps clear this up a little bit; have a great week.

omarsami7080

If you have an update -- which is security related on your plugins, is the 24hrs also applied. So you need to wait a day, before it is available by on all sites?

Which kind of doesn't sound logical.

aLLengoMEZ

omarsami7080 wrote
If you have an update -- which is security related on your plugins, is the 24hrs also applied.

Yes it exists so that when the new version is published, there is more time for scanners to "see" that there's a bug that needs to be addressed. Prior to release: there is not a way for scanners to check millions of site that may install the latest security update right away.

For site owners who realize that there is a bug in the latest version that needs to be fixed immediately, the 24-hour wait doesn't stop them from downloading and installing it at any time right after the new update is published.

So a site can be manually upgraded to the latest release the moment it is published, without waiting for the 24-hour clock to hit zero...

Right?

solarbadger

For myself (as a developer), the sites I look after are on managed hosting.

In that case, when WP released 7.0.2, the host applied that to every site within hours then sent out an email afterwards saying they'd done so.

Maybe the site owner never had a choice in it - they could only accept it.

So yes, there's an argument to be made about testing on staging first.

But when the host does this automatically across all its sites, a simple email after the fact is all you get.

wildanchor

Which host? Ours sends confirmation email first and then nag for a week.

solarbadger

A mid-size Dutch host, with that process which in reality works a lot worse since people seldom read these confirmation emails.

Rickey

@anita.rath: We like this setup as well:

All core updates which are only minor version updates happen automatic
All plugin updates are held back and go through a weekly check on staging
All plugin updates that are flagged as a 'security update' (not by WP, but by the plugin) will be done by hand the same day

@anita.rath: I wonder if its too slow to check all plugins weekly for you.

anita.rath

Weekly is perfectly fine for feature updates.

For security-related plugin updates i agree, it should happen the same day. i know a bit about the Stripe for WooCommerce payment validation advisory this month. Surely i dont want that one to wait a week for fixing 🙂

Maryam-Razi

and how do we identify this as a security release when the changelog for a plugin only states bug fixes?

Mattia

With WordPress Core - The post will always say it's a security release. If it's a plugin - read the changelog and anything that references a security / vulnerability can be treated as today's...