WordPress 7.0.3 Addresses Multiple Critical Security Vulnerabilities
WordPress 7.0.3 has been released with fixes for numerous security flaws, including pre-authentication XSS, privilege escalation, and SSRF, urging immediate updates for all users.
WordPress has released version 7.0.3, a critical security update addressing a wide array of vulnerabilities that could impact user data and site integrity. The release, available for immediate download and update, urges all WordPress users to apply the patches as soon as possible to protect their websites.
The update tackles several significant security issues, including a pre-authentication reflected cross-site scripting (XSS) vulnerability on the login screen. This flaw, reported by pwn.ai, could potentially lead to PHP code execution if exploited. Additionally, multiple stored XSS vulnerabilities have been patched across various components, including posts, blocks, and the Quick Edit interface, affecting sites with a large number of users. These XSS flaws were reported by researchers such as Asaf Mozes, n05ec, Naveen S, Ajmal Moochingal, and Alex Concha.
Further enhancing security, WordPress 7.0.3 resolves a privilege escalation issue on multisite networks where user registration is enabled. This vulnerability could allow a regular user to create a new site on the network. Information disclosure vulnerabilities have also been addressed, including one in the Latest Comments block that could expose comments on password-protected posts, and another related to the disclosure of notes in comment feeds. The release also patches an issue with CSS injection via a bypass of the safe CSS attribute filter, reported by Anthropic.
Technical details reveal that the update also fixes a server-side request forgery (SSRF) vulnerability in the URL validation process. This flaw could allow attackers to make requests to link-local ranges, potentially leading to unauthorized access or information leakage. A bypass of the email address confirmation flow was also addressed, along with an enumeration of post slugs vulnerability.
In response to the severity of these issues, the WordPress security team has worked to backport the fixes to older, supported versions of WordPress, specifically through version 4.7. While only the most recent versions receive active support, these backports aim to provide a wider safety net for the ecosystem. WordPress 7.1 Release Candidate 2 has also been updated to include these critical fixes.
The advisory specifically calls out CVE-2026-64638 and GHSA-52p2-r8wf-jcrf for the pre-authentication XSS vulnerability on the login screen, highlighting its potential for severe impact. The release acknowledges the contributions of numerous security researchers and WordPress core contributors who responsibly reported and helped fix these vulnerabilities.
Users can update their WordPress sites by visiting the Dashboard → Updates section and clicking 'Update Now,' or by downloading the latest version from WordPress.org. Sites configured for automatic background updates will receive the patch automatically. The WordPress security team emphasizes that staying current with releases is the most effective way to maintain site security against the ever-evolving threat landscape.
This comprehensive security release underscores the ongoing efforts to maintain the security and stability of the world's most popular content management system. The proactive patching of numerous vulnerabilities, ranging from client-side attacks like XSS to more critical server-side issues like SSRF and privilege escalation, demonstrates the commitment to protecting millions of websites globally.