WordPress 7.0.3 patches 12 security flaws

WordPress has released version 7.0.3, a security update that resolves 12 vulnerabilities in the core platform. The release targets cross-site scripting (XSS), server-side request forgery (SSRF), privilege escalation, and information disclosure risks, with fixes backported to all supported branches down to 4.7 where applicable.

What was fixed

The update addresses four distinct XSS vectors. A pre-authentication reflected XSS flaw on the login screen, tracked as CVE-2026-64638, could potentially lead to PHP code execution. Three additional stored XSS issues affect the Post Content block, Quick Edit interface on sites with large user bases, and the Post Date block, all requiring contributor-level access or higher. A separate privilege escalation bug in multisite networks with user registration enabled allows attackers to create new sites without proper authorization.

Other fixes include an SSRF vulnerability in URL validation that permits requests to link-local IP ranges, an information disclosure flaw in the Latest Comments block exposing comments on password-protected posts, and a bypass of the email address confirmation flow. The release also patches a CSS injection risk via a filter bypass in the safe CSS attribute system and an enumeration issue allowing disclosure of post slugs.

Update process and timeline

The security team released WordPress 7.0.3 on 6 August 2026. Sites supporting automatic background updates began receiving the patch shortly after publication. Manual updates can be initiated via the WordPress dashboard or by downloading the release directly from WordPress.org. The team is progressively backporting fixes to older branches, with WordPress 7.1 Release Candidate 2 already incorporating all relevant patches.

WordPress maintains that only the most recent major version receives active support, though security fixes are extended to older branches as a courtesy. The project credited 14 external researchers and multiple internal contributors for responsibly disclosing vulnerabilities and assisting with remediation.

Impact and recommendations

The vulnerabilities affect all WordPress installations running versions prior to 7.0.3, including multisite networks and sites using the block editor. While some flaws require authenticated access, the pre-auth XSS and SSRF risks present higher-severity exposure for unpatched sites. Operators of high-traffic or multisite environments should prioritize testing and deployment, particularly where user registration is enabled.

The WordPress Security Team has not reported active exploitation of these vulnerabilities at the time of release. However, the public disclosure of technical details in the CVE and GHSA advisories increases the likelihood of targeted attacks against unpatched installations.