The WordPress team has shipped 7.0.3, a security release that patches twelve vulnerabilities across core. The most severe, CVE-2026-64638, is a pre-auth reflected XSS on the login screen that under certain conditions can escalate to PHP code execution on the server. If you run WordPress and haven’t updated yet, now is the time.
What 7.0.3 actually fixes
Alongside the login-screen XSS, the release closes a privilege escalation flaw on multisite networks – a low-privileged attacker could, under specific conditions, gain administrator-level access across the entire network. The remaining fixes cover several stored XSS issues scattered across the admin area, which could serve as an entry point for attacks against logged-in users.
Why pre-auth XSS is so dangerous
Not requiring authentication puts this bug in the highest risk tier – an attacker only needs to get a victim to open a link to your site’s login page, no interaction with a real user account required, to inject a malicious script. Combined with a path to PHP code execution, this is potentially a full server compromise, not just a cosmetic issue.
What to do right now
Most sites on shared hosting update automatically, but relying on that is risky – auto-updates sometimes fail to trigger because of a plugin conflict or a custom core modification. Check your version under WP Admin → Dashboard → Updates, and if you see anything below 6.9.5 or 7.0.3, update manually. Back up first regardless – that’s standard security hygiene, not something specific to this bug.
Conclusion
Security patches of this scope aren’t the exception in WordPress – they’re routine, and what matters is how fast you respond. Not sure whether your site is up to date, or would rather hand the update off to someone else? Reach out and we’ll check it and handle a safe upgrade for you.
