WordPress 7.0.3 is available now, and it is a security update that site owners should prioritize. Released on August 6, 2026, it fixes 12 security issues in WordPress Core. The most detailed public advisory covers CVE-2026-64638, a pre-auth reflected XSS vulnerability on the login screen rated High with a CVSS score of 8.9.
WordPress recommends updating sites immediately. The release announcement also says installations that support automatic background updates will begin receiving the patch. See the official WordPress 7.0.3 announcement and the CVE-2026-64638 advisory for primary-source details.
Quick answer: if you run WordPress 7.0.0, 7.0.1, or 7.0.2, update to 7.0.3 or a later stable release that already contains the fix. If you temporarily remain on an older branch, verify its specific backport. Back up the site before maintenance, then confirm the installed version, Core checksums, and critical application flows.
What WordPress 7.0.3 fixes
The release covers several vulnerability classes. They do not all have the same impact or exploitation requirements, so describing all 12 as “critical RCEs” would be inaccurate. WordPress lists these fixes:
| # | Security issue | Context |
|---|---|---|
| 1 | Pre-auth reflected XSS on the login screen with potential to lead to PHP code execution | CVE-2026-64638; this issue has a detailed public advisory |
| 2 | Stored XSS through the emoji settings element | Requires Contributor or higher |
| 3 | Stored XSS in the Post Content block | Requires Contributor or higher |
| 4 | Stored XSS in Quick Edit on sites with a large number of users | Requires Contributor or higher |
| 5 | Stored XSS in the Post Date block | Requires Contributor or higher |
| 6 | Privilege escalation on multisite networks with user registration enabled | Could allow a user to create a new site |
| 7 | Information disclosure in the Latest Comments block | Could expose comments from password-protected posts |
| 8 | Post slug enumeration | Disclosure of content metadata |
| 9 | Disclosure of notes in comment feeds | Information appearing where it should not be exposed |
| 10 | CSS injection through a safe CSS attribute filter bypass | Requires Author or higher |
| 11 | Email address confirmation flow bypass | Affects email validation behavior |
| 12 | SSRF in URL validation | Could allow requests to link-local ranges |
The mix matters operationally. Several issues require an authenticated user with a particular role, while CVE-2026-64638 affects a surface reachable before login. The safest response is to install the complete security release instead of trying to decide which individual fixes can be ignored.
CVE-2026-64638: how serious is it?
The WordPress advisory describes CVE-2026-64638 as a pre-auth reflected XSS vulnerability on the login screen. It is rated High with a CVSS v4 score of 8.9. The published metrics specify a network attack vector, high attack complexity, no privileges required, and active user interaction.
That interaction requirement is important. The advisory says a specially crafted malicious third-party website can turn the XSS into PHP code execution under additional conditions that are outside the attacker's full control. Successful exploitation of that escalation requires social engineering and explicit interaction by the victim.
So it is misleading to call CVE-2026-64638 an “automatic unauthenticated RCE.” The initial surface is pre-auth, but the documented escalation requires a victim action and additional conditions. It is still a serious vulnerability and WordPress recommends an immediate update; describing it accurately simply keeps the alert useful instead of sensational.
Affected versions for CVE-2026-64638
The public advisory lists affected branches from WordPress 4.7 through 7.0 before their respective patched releases. For recent branches:
| Branch | Affected by CVE-2026-64638 | Patched version |
|---|---|---|
| 7.0 | 7.0.0–7.0.2 | 7.0.3 |
| 6.9 | 6.9.0–6.9.5 | 6.9.6 |
| 6.8 | 6.8.0–6.8.6 | 6.8.7 |
| 6.7 | 6.7.0–6.7.5 | 6.7.6 |
| 6.6 | 6.6.0–6.6.5 | 6.6.6 |
WordPress is also backporting security fixes, where necessary, to eligible branches as far back as 4.7. However, the project explicitly reminds users that only the latest WordPress version is actively supported. Receiving this one backport should not be treated as a reason to stay indefinitely on an old branch.
How to update WordPress 7.0.3 safely
You can install the update from Dashboard → Updates → Update Now. Administrators who manage WordPress from the command line can use WP-CLI to make the maintenance process reproducible.
1. Check the installed version and create a backup
Before changing production, keep a copy of both the database and site files. Store the backup outside the public document root and make sure you know how to restore it. WordPress' official backup guidance recommends backing up both the database and files before an upgrade.
