WordPress 7.0.3 Security Update: What PH Site Owners Must Do
Update to WordPress 7.0.3 (or your version's backported equivalent) right away — most hosts with automatic background updates will apply it for you, but don't assume, confirm it. Then check who has Contributor-level access to your site and make sure a current backup exists before and after the update. If you run WordPress Multisite, treat this as urgent.
WordPress released version 7.0.3 on August 6, 2026, fixing 12 vulnerabilities in core, including a high-severity login-page cross-site scripting flaw (CVE-2026-64638, CVSS 8.9) that researchers showed can lead to full site takeover under the right conditions. This article breaks down what actually changed, who is most exposed, and the exact steps to take on your WordPress site this week.
Table of contents
What Changed in WordPress 7.0.3
On August 6, 2026, WordPress released version 7.0.3 as a security-only release, patching 12 vulnerabilities across WordPress core. It isn't a feature update — no new blocks, no redesigned admin screens, just fixes. WordPress's own advisory is direct about it, recommending that site owners update immediately.
If your site supports automatic background updates, it may already have received this release without you doing anything. That's worth confirming rather than assuming. Log in to your WordPress Dashboard, open Updates, and check that your version reads 7.0.3, or the matching patched version for your branch if you're on an older release (more on that below).
The Headline Risk: A Login Page That Can Be Turned Against You
The most serious of the 12 fixes is tracked as CVE-2026-64638, a reflected cross-site scripting (XSS) flaw on the WordPress login screen, rated 8.9 out of 10 in severity. Security researchers at pwn.ai found that a specially crafted username, submitted through a failed login attempt, can slip past WordPress's input filtering and plant working code on the page. No account or password is needed to trigger that part.
On its own, that's already worth fixing. What makes it more serious is what researchers demonstrated it can lead to: if a logged-in Administrator clicks one attacker-controlled link, the injected code can ride along in their browser session, request a new API credential in their name, and use that credential to upload a plugin file containing PHP code, all without the attacker ever learning the Administrator's password.
Two things are worth keeping in perspective. First, this isn't a worm; it doesn't spread from site to site on its own. It requires one specific Administrator, on one specific site, to click one specific crafted link, which is why the security advisory describes the code-execution path as depending on successful social engineering plus explicit victim interaction. Second, no confirmed in-the-wild exploitation had been publicly reported as of August 7, 2026. That absence of a public report is not proof the flaw hasn't been used, and it isn't a reason to wait: a CVSS 8.9 flaw on a platform this widely deployed draws attention fast. Treat this as a phishing-style risk to guard against rather than a sign that your site is already compromised.
The Other 11 Fixes, Briefly
The rest of the release is lower severity, but a few are worth knowing about depending on how your site is run:
- Four stored XSS issues affect anyone with Contributor-level access or higher, in the Post Date block, the Post Content block, Quick Edit, and the emoji settings element. If you work with guest writers, freelance content teams, or outside contributors who have posting access, this group is the one to pay attention to.
- A privilege escalation bug on WordPress Multisite networks with open user registration lets a registered user create new sites they shouldn't be able to. This only affects Multisite installations; most single-site small business websites can skip this one.
- Three information-disclosure issues don't hand over admin access, but they can leak comments on password-protected posts, expose hidden post slugs, or reveal notes meant to stay private in comment feeds.
- A CSS injection bug, an email-verification bypass, and a server-side request forgery (SSRF) issue round out the release. The SSRF fix matters most for self-managed sites, since it closes a path an attacker could otherwise use to probe internal network addresses from your server.
If You're Running an Older Version of WordPress
WordPress backported fixes generously this time, all the way down through the 4.7 branch. The table below gives you the shape of it.
| Your WordPress Branch | Patched Version | What It Means |
|---|---|---|
| 7.0.x | 7.0.3 | Fully patched — update now if you haven't |
| 6.0–6.9 | Matching release, e.g. 6.9.6, 6.8.7, 6.7.6, 6.6.6 | 8–11 of 12 issues fixed — update now |
| 4.7–5.9 | Matching x.x.x patch for your branch | 7–8 of 12 issues fixed — update now, and plan a move to a current major version |
| 4.6 and earlier | None released | No longer receive security updates — a bigger risk than any single CVE in this release |
If you're not sure which branch your site is on, your hosting control panel or WordPress Dashboard will show the exact version number.
Checklist: What to Do This Week
- Check your version. Dashboard > Updates should show 7.0.3, or your branch's patched equivalent.
- Update now if it hasn't happened automatically. Many hosts with background updates enabled apply security releases like this one without a support ticket, but confirm rather than assume.
- Back up before and after. A current backup makes recovery faster and reduces the risk of permanent data loss if an update causes a problem.
- Review access levels. Check who currently has Contributor, Author, or Administrator access, and remove anyone who no longer needs it, since several of this release's fixes only matter at that access level.
- If you run Multisite, treat the privilege-escalation fix as urgent, particularly if user registration is open.
- Turn on automatic updates for core, plugins, and themes going forward, so the next security release doesn't depend on you remembering to check. For business-critical sites, keep current backups and verify the site after each update, since not every plugin or theme update is risk-free.
Common Mistakes That Leave Sites Exposed
"My site looks fine, so I can update later." Reflected XSS doesn't announce itself. A site can be vulnerable for weeks with zero visible symptoms until someone is specifically targeted.
Assuming hosting automatically means updates happen. Web hosting and automatic WordPress core updates aren't always the same thing. Confirm what your specific host and plan actually cover instead of guessing.
Leaving old Contributor or Author accounts active long after a freelancer's or guest writer's project has ended.
Staying on an unsupported WordPress version because "it's always worked fine." WordPress 4.6 and earlier no longer receive security updates, this release included.
FAQ
Confirm it, don't assume it. Log in to your Dashboard and check that the version reads 7.0.3, or your branch's patched release. Automatic updates vary by host and by plan; some cover core only, others cover plugins and themes too.
No confirmed in-the-wild exploitation had been publicly reported as of August 7, 2026. That status can change quickly for a vulnerability this widely discussed, so updating promptly still matters regardless.
It means the malicious code only runs when a specific crafted link is clicked. It doesn't sit dormant on your site waiting to affect random visitors, which makes it a targeted, phishing-style risk rather than something that spreads on its own.
Update immediately, then check whether user registration is open on your network. If it is, the privilege escalation fix in this release applies directly to you.
Key Takeaways
- WordPress 7.0.3 (released August 6, 2026) fixes 12 vulnerabilities, headlined by a high-severity login-page XSS (CVE-2026-64638) that can escalate to code execution if an Administrator clicks a malicious link.
- No confirmed in-the-wild exploitation had been publicly reported as of August 7, 2026, but update promptly regardless, since that status can change quickly.
- Sites on WordPress versions 4.6 and earlier receive no security updates at all, which is a bigger long-term risk than this release on its own.
- Confirming your update, backing up your site, and reviewing who has posting access covers most of what this release calls for.
Let Z.com Handle the Updates For You
Z.com WordPress Hosting plans are designed to reduce routine maintenance, with managed WordPress updates, automated daily backups, and an easy-to-use WP Squared control panel built in. It's still worth confirming that important security updates have been applied and reviewing your site after each update. Our PH-based local support team is also on hand if you'd rather talk it through.
See WordPress Hosting Plans