If your site runs on WordPress, you’ve had two update notices land in your dashboard recently: version 7.0.3 on August 6, and version 7.0.4 on August 12.
What actually happened
WordPress 7.0.3 fixed 12 separate security issues in one release. The most serious was a pre-authentication cross-site scripting vulnerability in the login page itself – meaning it didn’t require an attacker to already have an account on the site, which is what makes it the highest severity item in the batch. Six days later, 7.0.4 landed with a narrower, single-issue fix: a remote code execution vulnerability tied to image processing (specifically sites using Imagick with Ghostscript for image uploads). Both releases were backported all the way down through very old WordPress branches, which is standard practice for anything this serious.
Why two releases in under a week isn’t actually alarming
It’s tempting to read “two security patches in six days” as a bad sign. It’s closer to the opposite. WordPress core has a large, active security team and a disclosure process built specifically so real vulnerabilities get found, reported, and patched fast — often before they’re ever exploited at scale. The alternative (slow, infrequent patching) is the actually dangerous version. A mature open-source project shipping fixes quickly is the system working as intended.
What this means for your site specifically
Sites with automatic background updates enabled typically pick up a release like this within hours without anyone needing to do anything. If you’re not certain your site auto-updates, it’s worth checking Dashboard → Updates directly rather than assuming. The two releases this month are also a good reminder of where the real risk usually sits on any WordPress site: not the core software itself, but the plugins, themes, and login credentials around it. Every hexweb.dev build avoids plugin bloat by design, which also means fewer third-party pieces that could introduce a vulnerability outside of WordPress core’s own patch cycle but core still needs to be kept current regardless.
Practical takeaway: if you manage your own WordPress site, confirm it’s on 7.0.4 (or whatever the current version is by the time you read this) rather than assuming an old auto-update setting has you covered.