WordPress 7.0.3 Security Update: 12 Fixes + Checklist

Short answer: WordPress 7.0.3 is an urgent security release published on August 6, 2026. It addresses 12 listed security issues, including a high-severity pre-authentication reflected XSS flaw on the login screen that can potentially lead to PHP code execution under specific conditions. Back up your site, install the latest patched release offered in Dashboard → Updates, clear caches, and verify the site immediately.

WordPress 7.0.3 update checklist

Confirm your current WordPress version in Dashboard → Updates.
Create a fresh database and files backup, and confirm that you know how to restore it.
Update WordPress core immediately to 7.0.3, or to the newest patched maintenance release shown for your older branch.
Clear page, object, CDN and browser caches so visitors receive patched files.
Test the login screen, editor, forms, checkout and other critical journeys.
Verify the installed version and review PHP/server security logs for unexpected errors or suspicious requests.
Patch forgotten staging and development sites if they are publicly reachable.

Why this update is urgent

The official WordPress release announcement recommends updating immediately because 7.0.3 is a security release. The most prominent issue is CVE-2026-64638 / GHSA-52p2-r8wf-jcrf, which GitHub rates as High.

The advisory describes it as a reflected cross-site scripting vulnerability on the WordPress login screen that does not require prior authentication. A specially crafted third-party website could potentially escalate the issue to remote code execution, but the advisory says that escalation requires successful social engineering and explicit interaction by the victim. That condition should not be mistaken for safety: the vulnerability is network-accessible and WordPress has issued patched versions.

What WordPress 7.0.3 fixes

WordPress lists 12 security fixes in this release. They cover several different attack and disclosure paths:

Pre-authentication reflected XSS on the login screen, with potential PHP code execution under specific conditions.
Stored XSS issues involving the emoji settings element, Post Content block, Quick Edit and Post Date block for users with contributor-level access or higher.
A multisite privilege-escalation issue when user registration is enabled.
Information disclosure involving the Latest Comments block and password-protected posts.
Post-slug enumeration and disclosure of notes in comment feeds.
An author-level CSS injection issue.
A bypass of the email-address confirmation flow.
A server-side request forgery (SSRF) issue in URL validation involving link-local ranges.

This is a summary for defenders, not exploitation guidance. For the exact wording and researcher credits, use the official release notes linked in the sources section.

How to update safely from WordPress Admin

1. Make a restorable backup

Back up both the database and site files. A backup is only useful if it can be restored, so confirm the backup job completed and note where the archive is stored. If your host offers an on-demand snapshot, create one before updating.

2. Install the patched core release

Open Dashboard → Updates and click Update Now. Sites with automatic background updates may already be patched, but do not assume: verify the version displayed in the dashboard.

If you maintain multiple sites, check every production site plus any public staging, demo or development copy. A neglected clone can still expose data, credentials or an entry point into related systems.

3. Clear caches and run a smoke test

Purge hosting, page, object and CDN caches. Then test:

homepage and important landing pages;
/wp-login.php and administrator login;
creating and editing a draft post;
contact, registration and password-reset forms;
cart and checkout on ecommerce sites;
REST API, cron and integrations important to the business.

WP-CLI commands for managed sites

Administrators with shell access can use WP-CLI. Run these commands from the WordPress installation directory and follow your normal change-control process:

wp core version
wp db export before-wordpress-security-update.sql
wp core update
wp core version
wp core verify-checksums

On multisite, also review Network Admin settings, user registration and site-creation behavior after updating. Do not use a database export as your only backup if uploads, themes, plugins or configuration files have changed.

What if you are not on WordPress 7.0?

WordPress has published patched maintenance releases for supported security branches back through WordPress 4.7. The official documentation lists the patched releases, including 6.9.6, 6.8.7 and corresponding updates for older branches. WordPress also emphasizes that only the newest WordPress version is actively supported.

The practical rule is simple: install the newest patched release offered for your branch now, then plan a tested upgrade to the current major version. WordPress 4.6 and earlier no longer receive these security updates.

If you were preparing for WordPress 7.1, keep release candidates off production. The applicable fixes are included in the newer 7.1 release candidate, but production websites should remain on a stable patched branch until the final release. See the earlier WordPress 7.1 testing checklist for staging guidance.

Post-update verification checklist

The dashboard or wp core version shows a patched version.
wp core verify-checksums reports no unexplained core-file changes.
Login, publishing, forms and transactions work normally.
PHP error logs do not show new fatal errors.
Security monitoring remains enabled; an update does not prove that a previously exposed site was never targeted.
Automatic minor core updates are enabled unless your managed workflow has an equally fast patching process.

Frequently asked questions

Is WordPress 7.0.3 a feature update?

No. It is a security release. The priority is to patch promptly and verify your critical site functions.

Does CVE-2026-64638 require a WordPress account?

No prior authentication is required for the reflected XSS issue. However, the advisory says escalation to code execution depends on successful social engineering and explicit victim interaction.

Will WordPress update automatically?

Sites that support automatic background updates should begin updating, according to WordPress. You should still confirm the installed version rather than relying on the assumption that the update completed.

Should I install WordPress 7.1 RC on a live site instead?

No. WordPress says release candidates remain development software and should not be installed on production or mission-critical sites. Use the latest stable patched release on production.

Official sources

Last checked: August 7, 2026. Security guidance can change as maintainers publish new details; use the official sources above for the latest status.