WordPress 7.0.3 Fixes 12 Security Vulnerabilities: Update Your Site Now

WordPress 7.0.3 Is Here — And This Is an Update You Should Not Ignore

If you run a WordPress website, now is the time to update it.

The WordPress 7.0.3 security release, published on August 6, 2026, fixes 12 different security vulnerabilities affecting the WordPress core. Unlike a major release that introduces new features or design improvements, this update focuses entirely on protecting websites from known security threats.

Some of these vulnerabilities are considered highly dangerous. The most critical one, tracked as CVE-2026-64638, has a CVSS severity score of 8.9 (High) and could allow attackers to execute malicious PHP code under certain conditions.

Whether you manage a personal blog, an online store, a company website, or a multisite network, installing this update should be one of your top priorities.

In this article, we’ll explain what changed in WordPress 7.0.3, why these vulnerabilities matter, which versions are affected, and how you can update your website safely.

What Is WordPress 7.0.3?

WordPress 7.0.3 is a security-only maintenance release for the WordPress core.

Unlike feature releases that introduce new functionality, this version contains no new blocks, design improvements, or editor enhancements. Instead, it focuses on fixing vulnerabilities discovered by security researchers before attackers could exploit them.

The WordPress Security Team worked together with researchers from organizations including:

Their responsible disclosure helped the WordPress project patch these issues before they became widespread security incidents.

The WordPress team also thanked everyone who reported the vulnerabilities responsibly and helped improve the security of millions of WordPress websites worldwide.

Why This Security Update Matters

Cybercriminals continuously search for websites running outdated software.

Once security vulnerabilities become public, attackers begin creating automated tools that scan the internet for websites that have not yet installed the latest updates.

That is why security releases like WordPress 7.0.3 are important.

Updating quickly helps protect your website from:

Although many of the vulnerabilities require attackers to already have a Contributor or Author account, websites with multiple users are particularly at risk if they delay updating.

The Most Critical Security Fix: CVE-2026-64638

Among the twelve vulnerabilities, one stands out as significantly more dangerous than the others.

Reflected Cross-Site Scripting (XSS) on the Login Screen

The vulnerability, officially tracked as CVE-2026-64638, affects the WordPress login page.

It is a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability with a CVSS score of 8.9, making it the highest-severity issue fixed in this release.

How the attack works

The attack cannot happen automatically.

Instead, it relies on social engineering.

An attacker creates a specially crafted login URL and convinces a WordPress administrator to click it.

If the administrator visits the malicious link, the attacker may be able to inject harmful JavaScript into the login page. Under specific conditions, this could eventually lead to PHP code execution through the Plugin Editor or Theme Editor, giving an attacker far greater control over the website.

Although this attack requires human interaction, phishing campaigns are common, making the vulnerability a serious concern.

Fortunately, WordPress has fixed the issue by adding proper output escaping and strengthening input validation in the affected files.

Other Security Vulnerabilities Fixed in WordPress 7.0.3

While CVE-2026-64638 receives the most attention, the remaining eleven vulnerabilities also deserve careful consideration.

Many of these issues require an authenticated user account with Contributor or Author permissions, but they can still pose significant risks for websites with multiple users.

Let’s take a closer look.

1. Stored XSS in the Post Content Block

Users with Contributor permissions or higher could inject malicious JavaScript through the Post Content block.

Stored XSS attacks are especially dangerous because the malicious code remains inside the website until it is removed.

Whenever another user, such as an administrator, opens the affected content, the harmful script may execute automatically.

2. Stored XSS in the Post Date Block

Another stored Cross-Site Scripting vulnerability affected the Post Date block.

Like the previous issue, Contributors or higher-level users could potentially inject malicious scripts that execute whenever the affected content is viewed.

3. Stored XSS Through Emoji Settings

WordPress also fixed a vulnerability involving the Emoji Settings element.

An authenticated Contributor could abuse this feature to inject harmful scripts into website content.

Although emoji settings may appear harmless, any input field that is not properly sanitized can become an attack vector.

4. Stored XSS in Quick Edit

The Quick Edit feature also received an important security patch.

On websites with a very large number of users, Contributors could exploit Quick Edit to inject malicious JavaScript.

While this issue affects only specific environments, large membership sites, educational platforms, and community websites should update immediately.

5. CSS Injection Through Safe CSS Filter Bypass

WordPress 7.0.3 also fixes an Author-level CSS Injection vulnerability.

Normally, WordPress uses a Safe CSS filter to block dangerous CSS properties.

However, researchers discovered that when the filter reached an internal processing limit, it incorrectly returned “allowed” instead of “blocked.”

An attacker with Author access could exploit this behavior to inject unexpected CSS into website content.

Although CSS injection is generally less dangerous than JavaScript injection, it can still:

6. Server-Side Request Forgery (SSRF) in URL Validation

One of the more technical vulnerabilities fixed in WordPress 7.0.3 involves Server-Side Request Forgery (SSRF).

In this case, WordPress could be tricked into making requests to internal network addresses that should never be accessible from outside.

This includes sensitive link-local IP ranges, such as:

169.254.0.0/16

These addresses are commonly used by cloud providers to expose metadata services.

Without proper protection, attackers could potentially access internal information that should remain private.

WordPress now blocks these additional address ranges during URL validation, significantly reducing the risk of SSRF attacks.

7. Information Disclosure in the Latest Comments Block

WordPress 7.0.3 fixes an information disclosure vulnerability in the Latest Comments block.

Under certain conditions, comments made on password-protected posts could appear in the Latest Comments block, even though the original post was not accessible to unauthorized visitors.

While this issue did not expose the entire protected post, it could reveal private discussions or sensitive information that should have remained hidden.

If your website contains private content, member-only posts, or confidential discussions, this security fix is especially important.

8. Disclosure of Notes Through Comment Feeds

Another information disclosure issue involved comment feeds.

Certain internal notes could unintentionally be exposed through RSS or other comment feed formats.

Although the leaked information was limited, attackers often combine small pieces of information from multiple sources to build larger attacks.

Preventing unnecessary information leaks is an important part of maintaining a secure website.

9. Post Slug Enumeration

WordPress also addressed a vulnerability that allowed attackers to enumerate post slugs.

A post slug is the readable part of a URL, such as:

example.com/wordpress-security-guide/

While post slugs are normally public for published content, this vulnerability could expose slugs that should not have been easily discoverable.

Attackers often use this information to:

Although this issue is not critical by itself, fixing it reduces unnecessary information exposure.

10. Privilege Escalation on WordPress Multisite

One of the more significant fixes in WordPress 7.0.3 affects WordPress Multisite installations.

If user registration was enabled on a multisite network, a regular registered user could potentially create a new website without proper authorization.

This is known as a privilege escalation vulnerability.

Fortunately, this issue affects only WordPress Multisite networks.

Single-site WordPress installations are not affected.

Organizations, universities, hosting providers, and businesses running multisite environments should install this update immediately.

11. Email Confirmation Flow Bypass

WordPress also patched a vulnerability that allowed users to bypass part of the email confirmation process.

Email verification is an important security feature because it confirms that a user actually controls the email address they provide.

Bypassing this step could lead to:

Although this issue is not as severe as the XSS vulnerabilities, fixing it improves the overall security and reliability of WordPress user registration.

Summary of All 12 Security Fixes

For a quick overview, here are all the vulnerabilities addressed in WordPress 7.0.3:

Why Multi-User Websites Should Pay Extra Attention

Several vulnerabilities fixed in WordPress 7.0.3 require an attacker to already have a Contributor or Author account.

At first glance, this may seem less serious.

However, many modern WordPress websites allow users to register accounts. Examples include:

If one of these accounts becomes compromised—or if a malicious user signs up legitimately—they may be able to exploit permission-related vulnerabilities.

For this reason, updating WordPress is only one part of maintaining good website security. Regularly reviewing user accounts, removing inactive users, and following the principle of least privilege are equally important.

Which WordPress Versions Are Affected?

One of the most notable aspects of this release is its broad impact.

The vulnerabilities affect every WordPress version from 4.7.0 through 7.0.2, covering nearly a decade of WordPress releases.

If your website is running any version within this range, it is vulnerable unless you install the latest security update for your branch.

The WordPress project has also backported these fixes to supported older branches, including:

This allows administrators who cannot immediately upgrade to WordPress 7.0.3 to receive the latest security patches while planning a full version upgrade.

However, it is important to remember that only the latest version of WordPress receives full active support. Updating to WordPress 7.0.3 remains the best long-term choice.

How to Update to WordPress 7.0.3

Updating WordPress usually takes only a few minutes.

Before starting, create a complete backup of your website, including your files and database. A recent backup allows you to restore your site if anything unexpected happens during the update.

You can update WordPress in one of two ways.

Option 1: Update from the WordPress Dashboard

Option 2: Download from WordPress.org

You can also download the latest version directly from the official WordPress website and perform a manual update if needed.

Automatic Updates

If your website has automatic background updates enabled, WordPress will install this security release automatically without requiring any action from you.

Even if automatic updates are enabled, it is still a good idea to verify that your site updated successfully.

Security Best Practices After Updating

Installing WordPress 7.0.3 is the most important step, but it should not be your only security measure.

To further protect your website, consider the following best practices:

Following these practices will significantly reduce your website’s risk of compromise.

Frequently Asked Questions (FAQs)

Is WordPress 7.0.3 a feature update?

No. WordPress 7.0.3 is a security-only release. It does not introduce new features or design changes. Its primary purpose is to fix security vulnerabilities in the WordPress core.

How many vulnerabilities does WordPress 7.0.3 fix?

WordPress 7.0.3 fixes 12 separate security vulnerabilities, including cross-site scripting (XSS), server-side request forgery (SSRF), privilege escalation, CSS injection, information disclosure, post slug enumeration, and an email confirmation bypass.

What is the most serious vulnerability fixed?

The most critical issue is CVE-2026-64638, a reflected XSS vulnerability affecting the WordPress login screen. It has a CVSS score of 8.9 (High) and could potentially lead to PHP code execution if an administrator is tricked into clicking a specially crafted malicious link.

Which WordPress versions are vulnerable?

All versions from WordPress 4.7.0 through 7.0.2 are affected. Supported older branches have received backported security fixes, but updating to WordPress 7.0.3 is strongly recommended.

Do I need to update if I use automatic updates?

Yes. Automatic updates should install WordPress 7.0.3 automatically if they are enabled, but you should still verify that the update completed successfully.

Are single-site WordPress installations affected by every vulnerability?

No. Some vulnerabilities specifically affect WordPress Multisite environments. However, several important vulnerabilities impact both single-site and multisite installations, so all users should update.

Stay Secure

Security updates are never as exciting as major feature releases, but they are often far more important.

WordPress 7.0.3 addresses 12 security vulnerabilities, including a high-severity reflected XSS flaw, multiple stored XSS issues, SSRF, privilege escalation, CSS injection, information disclosure bugs, and improvements to user account security.

The fact that these vulnerabilities affect nearly ten years of WordPress releases highlights why keeping your website up to date is essential. Once security patches are published, attackers can study them and begin targeting websites that remain unpatched.

Whether you run a personal blog, a WooCommerce store, a membership platform, or a multisite network, updating to WordPress 7.0.3 is one of the easiest and most effective ways to protect your website, your visitors, and your data.

If you haven’t updated yet, now is the time. Open your WordPress dashboard, install WordPress 7.0.3, and ensure your site is running the latest secure version. A few minutes spent updating today can help prevent much bigger security problems in the future.