Keeping WordPress websites safe

Dunham's policy is to set all WordPress websites to apply security updates automatically. For severe security vulnerabilities, we also confirm the security status of all managed WordPress installations.

A significant WordPress security vulnerability was publicly disclosed on July 17, 2026.

The vulnerability, commonly referred to as “CVE-2026-63030,” is a critical remote code execution (RCE) vulnerability affecting certain versions of WordPress Core. Under specific conditions, it could allow an unauthenticated attacker to execute malicious code on a vulnerable website. Due to its severity, the WordPress Security Team released emergency security updates and enabled automatic security updates for supported installations.

At Dunham Web, our policy is to set all WordPress websites to apply security updates automatically. We do not, however, rely solely on automatic updates.

Immediately following a disclosure like this, our technical team will review every WordPress website under our management to verify that:

• The latest WordPress security updates have been successfully installed.
• Core WordPress files are fully patched.
• Websites continue to operate normally following the updates.
• No additional remediation is required.

As with the July vulnerability, we prioritize confirming the security status of all managed WordPress installations to ensure our clients remain protected. We do this because there is sometimes a gap between the time that vulnerability is disclosed and the security patch is released, and another gap between the time a patch is released and when it is applied on a particular website. Our clients trust us to be vigilant about this. They appreciate that no action is required on their part. If we identify anything requiring attention during our review, we contact them directly.

Cybersecurity is an ongoing process, not a one-time event. Our team continuously monitors newly disclosed vulnerabilities and responds quickly to ensure client websites remains secure, up to date, and protected against emerging threats.