WordPress 7.0.3 is now available as a security release. Because this is a security update, WordPress recommends updating sites immediately.
Updates can be applied by visiting the site’s Dashboard → Updates and clicking Update Now, or by downloading the package from WordPress.org. Sites configured for automatic background updates will begin updating shortly.
Security Vulnerabilities Addressed
The release fixes several critical issues reported by security researchers. Key findings include:
- Pre-auth reflected cross-site scripting (XSS) on the login screen: Reported by pwn.ai, this vulnerability has the potential to lead to PHP code execution. (CVE-2026-64638)
- Contributor+ stored cross-site scripting (XSS): Affects the emoji settings element, Post Content block, Post Date block, and Quick Edit on sites with a large number of users.
- Privilege escalation on multisite networks: Enabled when user registration is active, allowing a user to create a new site.
- Server-side request forgery (SSRF): Found in URL validation, allowing requests to link-local ranges.
- Information disclosure: The Latest Comments block exposed comments on password-protected posts.
- Other issues: Enumeration of post slugs, disclosure of notes in comment feeds, and a bypass of the email address confirmation flow.
Additionally, an Author+ CSS injection vulnerability was addressed via a bypass of the safe CSS attribute filter.
Backports and Related Versions
As a courtesy, fixes are being backported to eligible branches (currently through version 4.7). WordPress 7.1 RC2 has also been released, containing applicable fixes.