John Cuthbert 
WordPress released version 7.0.3 on 6 August 2026 as a security release — not a feature update, not routine housekeeping. It patches 12 vulnerabilities, and one of them is serious enough that “update when you get round to it” isn’t the right posture here.
What’s actually at risk
The headline issue is a pre-authentication reflected XSS on the login screen, with the potential to escalate to PHP code execution. Pre-auth means an attacker doesn’t need an account on your site to trigger it — that’s what moves this from “patch eventually” to “patch now.”
The rest of the fixes cover a wide surface:
- Five contributor-level stored XSS issues across various blocks and features
- Privilege escalation on multisite networks with user registration enabled
- Information disclosure in the Latest Comments block
- Post slug enumeration and comment feed vulnerabilities
- A CSS injection bypass and an email confirmation flow bypass
- Server-side request forgery (SSRF) in URL validation
None of these need a rare, complex setup to matter — several apply to any default WordPress install running a supported version.
How to update
Most sites with automatic background updates enabled will already be updating themselves. If yours isn’t, or you want to confirm, go to Dashboard → Updates → Update Now, or run it via WP-CLI:
wp core update
wp core versionWordPress 7.1 RC2 shipped alongside this release with the same patches applied, so if you’re testing the upcoming 7.1 branch, you’re already covered.
The part that actually matters
Patch releases like this are exactly why “update WordPress” can’t be a once-a-quarter task. A pre-auth XSS with code execution potential sitting unpatched for even a few days on a production site is a real window of exposure — and it’s the kind of thing that’s trivial to miss if nobody’s specifically watching for it.
If you’re on a Development Retainer with us, this is already handled — it went into this week’s maintenance window the day it dropped.
