WordPress 7.0.3 Fixes 12 Security Issues, Including High-Severity Login XSS

Version 7.0.3 of WordPress fixed 12 security issues, including a high-severity reflected cross-site scripting (XSS) flaw on the login screen that does not require prior authentication. The release announcement, published on 6 August 2026, recommended that sites update immediately at the time of release. WordPress 7.0.4 followed on 12 August, and WordPress 7.1 was released on 19 August, so 7.0.3 is no longer the current release.

The login-screen vulnerability, CVE-2026-64638, is rated High at 8.9 under CVSS 4.0 in the WordPress GitHub security advisory. Its CVSS metrics list a network attack vector, high attack complexity, no privileges required, and active user interaction. The advisory says the reflected XSS can potentially be escalated to remote code execution through a specially crafted malicious third-party website, but doing so requires successful social engineering, explicit victim interaction, and conditions outside the attacker’s control.

The release also fixed four stored XSS issues affecting users with the Contributor role or higher. They involve the emoji settings element, Post Content block, Quick Edit on sites with large numbers of users, and Post Date block. A separate issue affecting users with the Author role or higher allows CSS injection through a bypass of the safe CSS attribute filter.

Other fixes reach beyond browser-side injection. WordPress addressed a multisite privilege-escalation issue that can allow a user to create a new site when user registration is enabled, and a server-side request forgery (SSRF) issue in URL validation that permits requests to link-local ranges. The release also lists a bypass of the email-address confirmation flow, post-slug enumeration, exposure of comments on password-protected posts, and disclosure of notes through comment feeds. The release announcement does not provide severity ratings for these other issues.

WordPress said the 7.0.3 fixes were being backported where necessary to all branches eligible for security fixes, reaching back to version 4.7, while reiterating that only the most recent version was actively supported. The advisory for CVE-2026-64638 lists patched releases from 4.7.34 through 7.0.3. These backports illustrate the distinction WordPress makes between providing security fixes for older branches and actively supporting the most recent release.

The update followed WordPress 7.0.2, released on 17 July 2026 with one critical and one high-severity security issue. WordPress.org enabled forced updates through its auto-update system for affected versions because of the severity of that release. One of the 7.0.2 advisories covers a REST API batch-route confusion and SQL injection issue leading to remote code execution. The two WordPress core security releases arrived 20 days apart.

For Drupal readers, the relevant comparison is maintenance practice rather than a claim that one CMS is more secure than another. The 7.0.3 release shows WordPress applying security fixes across current and older security-eligible branches while maintaining a separate distinction around active support. It provides a useful comparison point for how a large open-source CMS handles core vulnerabilities across long-lived deployments.