WordPress 7.0.3: The Login-Screen XSS You Can’t Ignore (and My Safe-Update Playbook)

The short version: update now

WordPress 7.0.3 landed on August 6, 2026, and it is a security release. If you run a WordPress site and you only read one sentence of this post, read this one: update to 7.0.3 today, or confirm your automatic background updates have already done it for you. This release patches 12 separate vulnerabilities, and the details are now public, which means the people who write automated attack scripts already know exactly what to look for on sites that haven’t updated.

I manage and build on WordPress every day, so I want to walk through what actually changed, which sites are most exposed, and the practical checklist I run through for my own clients whenever a security release like this drops.

What’s in WordPress 7.0.3

This is a maintenance and security release, not a feature release, so nothing on the front end of your site changes. What you get is a batch of quiet but important fixes. Across the 12 vulnerabilities, the core team addressed a mix of issue types: pre-authentication cross-site scripting (XSS), stored XSS, a privilege escalation bug, information disclosure, CSS injection, an email verification bypass, and server-side request forgery (SSRF).

The one that matters most

The headline issue is a pre-authentication reflected XSS vulnerability on the login screen, rated High with a CVSS score of 8.9. “Pre-authentication” is the part that should get your attention: an attacker doesn’t need to be logged in to exploit it. Reflected XSS on the login page can be chained toward more serious outcomes, and in this case there was potential to reach PHP code execution through the theme and plugin editor. That is about as bad as it gets for a WordPress vulnerability, because code execution effectively means full control of the site.

The others worth knowing about

A few of the remaining fixes stood out to me as a developer. There is a privilege escalation bug that only affects Multisite networks with user registration enabled, where a registered user could create sites they should never have been able to create. There are also some information disclosure problems: the Latest Comments block could leak comments from password-protected posts, comment feeds could expose private notes, and post slug enumeration made it easier to guess unpublished content. None of these are as loud as the login XSS, but information disclosure bugs are exactly how attackers do reconnaissance before a bigger move.

Who is most at risk

Every WordPress site should update, but a few situations raise the stakes. If you run a Multisite network with open registration, the privilege escalation bug is directly relevant to you. If you have disabled automatic background updates, which a lot of agencies and developers do on managed or staged sites, then nothing has happened automatically and the responsibility is entirely yours. And if you are running an older major version, you are not off the hook either.

One genuinely reassuring thing about the WordPress security process is how far back the fixes get backported. The team pushed patched versions to older branches as well, so there are updated releases available going back several major versions. That is great for the wider ecosystem, but it also means there is no excuse to stay unpatched because you’re “on an old version.”

My update checklist

Here is the exact sequence I follow when a WordPress security release comes out. It only takes a few minutes on most sites and it prevents the small number of updates that go sideways from ruining your day.

• Take a fresh backup first. Full files plus database. If anything breaks during the update, a backup turns a crisis into a five-minute rollback.
• Update core to 7.0.3. From the dashboard, go to Dashboard > Updates and run the update, or download it from WordPress.org. Sites with automatic background updates enabled were likely patched already, but verify the version number rather than assuming.
• Confirm the version. Check the footer of your admin dashboard or the Updates screen. It should clearly read 7.0.3.
• Clear your caches. Page cache, object cache, and any CDN cache. Stale caches are the most common reason a correct update appears not to have worked.
• Smoke-test the important pages. Load your homepage, log in and out, run a test checkout if you sell anything, and submit a contact form. Two minutes of clicking beats an angry client email.

If you can’t update immediately

Sometimes you can’t just click update, maybe you have heavy customizations or a client change-freeze. In that case, at minimum, put the update through a staging environment first, and lean on your web application firewall or security plugin to add a temporary layer while you schedule the core update properly. That is mitigation, not a fix, so treat it as a short bridge, not a destination.

Why automatic updates are worth trusting here

I used to be cautious about automatic core updates, and for major feature releases I still stage them. But minor security releases like 7.0.3 are exactly what the automatic update system was designed for. They are tightly scoped, heavily tested, and backported specifically so they can roll out safely across millions of sites. For most small business and content sites I look after, leaving automatic background updates on for minor and security releases is the right call. It means a release like this one is handled before I’ve even had my morning coffee.

The bigger lesson

WordPress powers a huge share of the web, and that popularity is exactly why it gets probed constantly. A release like 7.0.3 is a good reminder that security isn’t a one-time setup, it’s a habit: current core, current plugins and themes, real backups, and a firewall in front. None of it is glamorous, but it is the difference between a site that quietly runs for years and one that gets defaced or hijacked the week after a public disclosure.

If you’re not sure whether your site is on 7.0.3, or you’d rather have someone handle updates, backups, and hardening so you never have to think about it, that’s exactly the kind of work I do. Get in touch through my site and I’ll take a look.