WordPress 7.0.3: A Security Update You Shouldn’t Put Off

WordPress 7.0.3 was released on August 6, 2026. This is a security update.

As reported by Patchstack.com, a total of 12 security vulnerabilities were fixed in this release. They range from Cross-Site Scripting (XSS), privilege escalation, and information disclosure to Server-Side Request Forgery (SSRF).

If your website is still running an older version, it’s a good idea to update as soon as possible. Security updates are not just about fixing bugs. They also close security holes that could otherwise be used by attackers.

What Was Fixed?

Here are the types of security vulnerabilities addressed in this release:

• Pre-authenticated XSS
• Stored XSS
• Privilege escalation
• Information disclosure
• CSS injection
• Email verification bypass
• SSRF

Before updating a live website, make sure you have a recent backup. It’s also worth checking whether your current theme and plugins are still compatible.

1. XSS Vulnerability on the Login Page

The most notable issue is a reflected XSS vulnerability on the login page (CVE-2026-64638).

This vulnerability can be triggered without requiring the victim to log in first. However, there is an important detail: the attack does not spread automatically to other users.

The attacker has to create a specially crafted URL and then convince the victim to click it. If the victim is not an Administrator, the potential impact is more limited.

The real concern is when the victim is an Administrator. If that happens, malicious JavaScript could potentially take over the Administrator’s session. From there, an attacker could inject malicious code or install a malicious plugin. In the worst-case scenario, this could lead to remote code execution (RCE).

So while the vulnerability sounds serious, the attack still requires a “trap” of sorts — the Administrator has to actually open the malicious link.

2. Four Stored XSS Vulnerabilities

There are four other vulnerabilities with something in common: exploiting them requires at least Contributor-level access.

That makes them different from vulnerabilities that can be attacked without logging in at all.

Still, they are worth taking seriously, especially on websites with many authors. For example, websites that accept content from guest writers, freelancers, or content agencies often give these users Contributor access.

These four vulnerabilities are related to:

• Emoji settings in posts
• The Post Content block
• The Quick Edit feature
• The Post Date block

If your website has only a few trusted Contributors, the risk is naturally lower than on a website that gives writing access to a large number of people.

3. Privilege Escalation in WordPress Multisite

WordPress Multisite also received a security fix in this release.

Under certain conditions, when user registration is enabled, a regular user could create a new website even though they should not have permission to do so.

This vulnerability specifically affects WordPress Multisite. Regular single-site WordPress installations are not affected.

If you manage a WordPress Multisite installation, this update is particularly important. A single installation can manage many websites at once, so a security problem can potentially have a wider impact.

4. Information Disclosure

This release also closes several vulnerabilities that could expose information that should not be visible to everyone.

For example:

• The Latest Comments block could expose comments from password-protected posts.
• Post slugs could be enumerated.
• Comment feeds could expose private information.

Vulnerabilities like these do not immediately give an attacker Administrator access. However, leaked information can help an attacker gather details and prepare a more targeted attack.

5. CSS Injection, Email Bypass, and SSRF

Several other security vulnerabilities were also fixed.

CSS injection — this could be carried out by users with Author-level access or higher.

Email verification bypass — under certain conditions, the email verification process could be bypassed.

SSRF — this vulnerability affects URL validation. It deserves particular attention on servers that have access to internal networks, because it could potentially be used to send requests to locations that should not be directly accessible.

AI Is Starting to Play a Role in Finding Security Vulnerabilities

There is another interesting point in Patchstack’s report.

Along with the vulnerabilities fixed in this release, Patchstack also highlighted how security vulnerabilities are being discovered today.

AI is increasingly being used not only to analyze code, but also to find vulnerabilities and help develop exploits.

This is becoming a serious concern. The faster a vulnerability can be discovered and exploited, the less time website owners have to apply a patch.

Previously, Patchstack also reported how a critical vulnerability in WordPress 7.0.2 was exploited shortly after it was publicly disclosed.

In other words, delaying a WordPress update is no longer simply a matter of “I’ll do it when I have time.” The gap between a patch being released and active exploitation can be very short.

Should You Update to WordPress 7.0.3 Right Away?

Yes.

This is a security release. If your website is running an affected version, you should update as soon as possible.

Before updating a production website, especially one with a more complex setup, go through these steps first:

1. Back up your website files and database.
2. Check plugin and theme compatibility.
3. Update WordPress Core.
4. Test the website’s main functions.
5. Make sure there are no unfamiliar Administrator accounts.
6. Check your logs if the website shows any suspicious behavior.

For Multisite installations, also review user accounts and the websites that have been created.

Conclusion

WordPress 7.0.3 is more than just a routine update. It fixes 12 security vulnerabilities, including reflected XSS, stored XSS, privilege escalation, information disclosure, CSS injection, email verification bypass, and SSRF.

Not all of these vulnerabilities carry the same level of risk. Some require Contributor or Author access first. The reflected XSS vulnerability on the login page, meanwhile, can be triggered without authentication, but it still requires the victim to click a malicious link.

The bottom line is simple: don’t put off WordPress security updates.

If you manage your own WordPress website, check your version under Dashboard → Updates and make sure you’re running the latest available version.

For WordPress theme and plugin developers, releases like this are another reminder that security should be considered from the beginning of the development process, not only after a vulnerability has been discovered.