The WordPress development team has released WordPress 7.0.3, a security update addressing several vulnerabilities affecting the popular content management system. Because this is a security release, website administrators are strongly advised to update their WordPress installations as soon as possible.
WordPress 7.0.3 fixes a range of security issues, including several cross-site scripting (XSS) vulnerabilities, as well as privilege escalation, information disclosure and server-side request forgery (SSRF) flaws.
One of the most significant fixes addresses a pre-authentication reflected XSS vulnerability on the WordPress login screen. Under certain conditions, exploitation of the vulnerability could potentially lead to PHP code execution on the server. The issue was reported by the security research team at pwn.ai.
Several XSS vulnerabilities fixed
WordPress 7.0.3 addresses multiple stored XSS vulnerabilities that could be exploited by users with sufficient permissions.
The affected areas include the emoji settings element, the Post Content block, the Post Date block and the Quick Edit functionality on websites with a large number of users.
The release also fixes a CSS injection vulnerability that could be exploited by users with Author-level permissions or higher by bypassing the safe CSS attribute filter. This issue was reported by Anthropic.
Multisite and URL validation security fixes
A privilege escalation issue affecting WordPress Multisite networks with user registration enabled has also been addressed. The vulnerability could allow a user to create a new site under certain circumstances. The issue was reported by Aikido Security.
Another important fix addresses a server-side request forgery (SSRF) vulnerability in WordPress URL validation. The flaw could allow requests to be made to link-local address ranges.
Several information disclosure issues have also been fixed. The Latest Comments block could expose comments belonging to password-protected posts, while other vulnerabilities could allow post slugs to be enumerated or notes to be disclosed through comment feeds.
WordPress 7.0.3 also fixes a vulnerability that could allow the email address confirmation process to be bypassed.
Security fixes are being backported
The WordPress security team is also backporting the necessary fixes to older branches that remain eligible to receive security updates, currently going back as far as WordPress 4.7. These updates are still being prepared and will be released as they become available.
However, the WordPress team emphasizes that only the latest version of WordPress is actively supported, meaning website owners should not rely on security backports as an alternative to keeping their installations up to date.
WordPress 7.1 RC2 has also been released and includes all applicable security fixes.
The login screen XSS vulnerability is tracked as CVE-2026-64638 / GHSA-52p2-r8wf-jcrf.
WordPress 7.0.3 can be installed through the administration dashboard by navigating to Dashboard → Updates → Update Now. Websites that support automatic background updates should begin receiving the new version automatically.
Due to the number and potential impact of the vulnerabilities addressed in this release, WordPress administrators are advised to install the update without delay.
