On August 6, 2026, the WordPress team released WordPress 7.0.3. This is a security-only update, which means it does not include new features or design improvements. Instead, it fixes 12 security vulnerabilities in WordPress core.
Because these issues could expose websites to attacks, the WordPress team strongly recommends that all WordPress users update to version 7.0.3 as soon as possible.
A Critical Security Flaw Fixed
The most serious issue fixed in this release is CVE-2026-64638. It has a CVSS severity score of 8.9/10, making it a high-risk vulnerability.
This flaw is a reflected cross-site scripting (XSS) vulnerability on the WordPress login page. If exploited successfully, it could allow an attacker to execute PHP code through the built-in Plugin Editor or Theme Editor.
However, this attack is not automatic. An administrator must first click a specially crafted link created by the attacker. In other words, the attacker must rely on social engineering to exploit the vulnerability.
The WordPress developers fixed the issue by adding proper output escaping in several core files.
Other Security Fixes in WordPress 7.0.3
The remaining 11 vulnerabilities are generally less severe. Most of them require the attacker to already have a WordPress account with at least Contributor or Author permissions.
Stored XSS Vulnerabilities
WordPress fixed five stored cross-site scripting (XSS) vulnerabilities. These flaws could allow a Contributor or higher-level user to inject malicious JavaScript through several areas, including:
- Emoji settings
- Post Content block
- Post Date block
- Quick Edit on multi-user websites
CSS Injection
The update also fixes a CSS injection vulnerability. An attacker with Author privileges could bypass the Safe CSS filter and inject unsafe CSS.
Information Disclosure Issues
Several fixes prevent sensitive information from leaking.
These include:
- Comments on password-protected posts appearing in the Latest Comments block.
- Notes leaking through comment feeds.
- Post slug enumeration, which could reveal unpublished or hidden content identifiers.
Privilege Escalation in Multisite
WordPress also fixed a privilege escalation issue in multisite installations with user registration enabled. Without the patch, a regular user could create a new site on the network without proper authorization.
SSRF and Email Verification Fixes
The release also addresses:
- A Server-Side Request Forgery (SSRF) issue in URL validation that could allow requests to internal network addresses.
- A bypass in the email address confirmation process.
Which WordPress Versions Are Affected?
One notable aspect of this release is its wide impact.
These vulnerabilities affect every WordPress version from 4.7.0 through 7.0.2, covering nearly 10 years of WordPress releases.
If you run any version in that range, your website remains vulnerable until you install the latest security update.
The good news is that the WordPress team has backported these fixes to supported older branches. Security releases are available for versions such as 6.9.6, 6.8.7, and 6.7.6.
Even so, you should upgrade to WordPress 7.0.3 whenever possible. The latest version receives full support, bug fixes, and future improvements.
How to Update to WordPress 7.0.3
Updating WordPress only takes a few minutes.
You can update your website in one of two ways:
- Download the latest version from WordPress.org.
- Log in to your WordPress dashboard, go to Dashboard → Updates, and click Update Now.
If your website uses automatic background updates, WordPress will install the update automatically.
Why You Should Update Immediately
Once WordPress publishes security patches, attackers can study them and identify the vulnerabilities they fix. As a result, unpatched websites often become attractive targets.
For that reason, you should install WordPress 7.0.3 without delay.
This is also a good opportunity to review your user accounts. Remove inactive or unnecessary accounts because many of the fixed vulnerabilities require an authenticated user to exploit.
Update Your Site Now
WordPress 7.0.3 may not introduce new features, but it delivers an important security update that protects millions of websites.
If your site runs any version between 4.7.0 and 7.0.2, update it immediately. The process is quick, and it significantly reduces your website’s security risk.
For complete technical details about this release, visit the official WordPress 7.0.3 release documentation on WordPress.org.
