WordPress 7.0.3 is available now, and it is a security update that site owners should prioritize. Released on August 6, 2026, it fixes 12 security issues in WordPress Core. The most detailed public advisory covers CVE-2026-64638, a pre-auth reflected XSS vulnerability on the login screen rated High with a CVSS score of 8.9.
WordPress recommends updating sites immediately. The release announcement also says installations that support automatic background updates will begin receiving the patch. See the official WordPress 7.0.3 announcement and the CVE-2026-64638 advisory for primary-source details.
Quick answer: if you run WordPress 7.0.0, 7.0.1, or 7.0.2, update to 7.0.3 or a later stable release that already contains the fix. If you temporarily remain on an older branch, verify its specific backport. Back up the site before maintenance, then confirm the installed version, Core checksums, and critical application flows.
What WordPress 7.0.3 fixes
The release covers several vulnerability classes. They do not all have the same impact or exploitation requirements, so describing all 12 as “critical RCEs” would be inaccurate. WordPress lists these fixes:
| # | Security issue | Context |
|---|---|---|
| 1 | Pre-auth reflected XSS on the login screen with potential to lead to PHP code execution | CVE-2026-64638; this issue has a detailed public advisory |
| 2 | Stored XSS through the emoji settings element | Requires Contributor or higher |
| 3 | Stored XSS in the Post Content block | Requires Contributor or higher |
| 4 | Stored XSS in Quick Edit on sites with a large number of users | Requires Contributor or higher |
| 5 | Stored XSS in the Post Date block | Requires Contributor or higher |
| 6 | Privilege escalation on multisite networks with user registration enabled | Could allow a user to create a new site |
| 7 | Information disclosure in the Latest Comments block | Could expose comments from password-protected posts |
| 8 | Post slug enumeration | Disclosure of content metadata |
| 9 | Disclosure of notes in comment feeds | Information appearing where it should not be exposed |
| 10 | CSS injection through a safe CSS attribute filter bypass | Requires Author or higher |
| 11 | Email address confirmation flow bypass | Affects email validation behavior |
| 12 | SSRF in URL validation | Could allow requests to link-local ranges |
The mix matters operationally. Several issues require an authenticated user with a particular role, while CVE-2026-64638 affects a surface reachable before login. The safest response is to install the complete security release instead of trying to decide which individual fixes can be ignored.
CVE-2026-64638: how serious is it?
The WordPress advisory describes CVE-2026-64638 as a pre-auth reflected XSS vulnerability on the login screen. It is rated High with a CVSS v4 score of 8.9. The published metrics specify a network attack vector, high attack complexity, no privileges required, and active user interaction.
That interaction requirement is important. The advisory says a specially crafted malicious third-party website can turn the XSS into PHP code execution under additional conditions that are outside the attacker's full control. Successful exploitation of that escalation requires social engineering and explicit interaction by the victim.
So it is misleading to call CVE-2026-64638 an “automatic unauthenticated RCE.” The initial surface is pre-auth, but the documented escalation requires a victim action and additional conditions. It is still a serious vulnerability and WordPress recommends an immediate update; describing it accurately simply keeps the alert useful instead of sensational.
Affected versions for CVE-2026-64638
The public advisory lists affected branches from WordPress 4.7 through 7.0 before their respective patched releases. For recent branches:
| Branch | Affected by CVE-2026-64638 | Patched version |
|---|---|---|
| 7.0 | 7.0.0–7.0.2 | 7.0.3 |
| 6.9 | 6.9.0–6.9.5 | 6.9.6 |
| 6.8 | 6.8.0–6.8.6 | 6.8.7 |
| 6.7 | 6.7.0–6.7.5 | 6.7.6 |
| 6.6 | 6.6.0–6.6.5 | 6.6.6 |
WordPress is also backporting security fixes, where necessary, to eligible branches as far back as 4.7. However, the project explicitly reminds users that only the latest WordPress version is actively supported. Receiving this one backport should not be treated as a reason to stay indefinitely on an old branch.
How to update WordPress 7.0.3 safely
You can install the update from Dashboard → Updates → Update Now. Administrators who manage WordPress from the command line can use WP-CLI to make the maintenance process reproducible.
1. Check the installed version and create a backup
Before changing production, keep a copy of both the database and site files. Store the backup outside the public document root and make sure you know how to restore it. WordPress' official backup guidance recommends backing up both the database and files before an upgrade.
wp core version
wp core check-update
wp db export /srv/wordpress-private-backups/backup-before-wordpress-7.0.3.sql
The directory above is an example only. Create it with appropriate permissions outside the document root. A database export alone also does not replace a backup of wp-content, wp-config.php, and the other files required to recover the installation.
2. Install the patch
If your maintenance procedure requires pinning exactly WordPress 7.0.3:
Protect WordPress from the infrastructure layer
Run your site in an environment built for updates, backups, and stable WordPress operations.
wp core update --version=7.0.3
wp core update-db
The official WP-CLI documentation confirms that wp core update updates WordPress and that --version selects a specific release. If a later stable release containing these fixes exists by the time you perform maintenance, review that release rather than pinning the site to 7.0.3 without a reason.
3. Verify the result
wp core version
wp core verify-checksums
Then test the frontend, /wp-login.php, the dashboard, forms, outbound mail, cron tasks, and every business-critical flow. For WooCommerce or membership sites, include the cart, checkout, authentication, and webhooks in your validation.
wp core verify-checksums helps compare Core files against official packages, but it does not inspect all of wp-content, the database, or plugin and theme behavior. It is a Core integrity check, not a complete forensic scanner.
Does updating prove that the site was never compromised?
No. Installing a patched version removes the known vulnerable Core code for that branch, but it cannot prove retrospectively that a site was never exploited while exposed. At the same time, the primary sources reviewed for this article do not state that CVE-2026-64638 is under active exploitation, so there is no basis here for claiming a mass compromise either.
If a site shows unusual signs—unknown users, unexpected file changes, redirects, PHP files inside uploads, unfamiliar plugins, or suspicious log activity—preserve evidence and investigate further. For a different WordPress Core attack chain that required its own security response, read our analysis of WP2Shell in WordPress.
What about WordPress 7.1?
WordPress states that 7.1 RC2 also contains all applicable security fixes from this release. The final WordPress 7.1 release is planned around WordCamp US 2026, August 16–19.
That does not make a Release Candidate the preferred production build. If your production site is currently on 7.0.x, install a patched stable release. Use RC builds in staging or test environments to validate themes, plugins, and integrations before moving to WordPress 7.1 stable.
WordPress administrator checklist
- Inventory the actual version of every WordPress installation you manage.
- Update WordPress 7.0.x to 7.0.3 or a later stable version containing the fixes.
- If you remain on an older branch, verify its specific CVE-2026-64638 backport.
- Back up the database and site files before the maintenance window.
- Confirm the installed version after the update.
- Verify Core checksums and investigate unexpected differences.
- Test login, dashboard, frontend, and business-critical site flows.
- Review logs and recent changes when there are signs of compromise.
- Do not treat a WAF or security plugin as a replacement for an available Core patch.
WordPress 7.0.3 FAQ
Is WordPress 7.0.3 a security release?
Yes. WordPress released it on August 6, 2026 with multiple security fixes and recommends updating sites immediately.
Does CVE-2026-64638 provide RCE without any user action?
That is not what the advisory says. The vulnerability is a pre-auth reflected XSS that can escalate to PHP code execution under additional conditions. The documented chain requires social engineering and explicit victim interaction.
Can I update to WordPress 7.0.3 with WP-CLI?
Yes. Use wp core update --version=7.0.3 when you specifically need that release. Back up the site first, then confirm the installed version and run your verification checks.
Does a firewall or security plugin replace the update?
No. Those controls can add defensive layers, but they do not remove vulnerable WordPress Core code. When an official patch is available, installing it is the primary remediation.
Conclusion
WordPress 7.0.3 deserves priority because it includes 12 security fixes and patches CVE-2026-64638, rated CVSS 8.9. The practical response is straightforward: back up, update, verify, and test. There is no need to exaggerate the risk to justify the maintenance; WordPress itself recommends updating immediately.
After patching, use the maintenance window to review site health and performance. Our guide to troubleshooting a slow WordPress site is a useful next checklist. If you need a platform designed to run WordPress workloads, see our Web Hosting.
