WordPress 7.0.3 Security Release: 12 Vulnerabilities Patched and What AI-Driven Research Means for Your Site

digital interactive web development hero image

WordPress released version 7.0.3 on August 6, 2026 — a security-only update that patches 12 vulnerabilities, including a pre-authentication login-screen XSS with a path to PHP code execution and the tail end of an actively exploited remote code execution chain. If your site has not updated yet, it should be at the top of your list today.

What WordPress 7.0.3 Fixes

The release addresses a broad range of vulnerability classes. According to the official WordPress documentation, the 12 fixes cover pre-auth reflected cross-site scripting (XSS) on the login screen, stored XSS in post blocks, privilege escalation on multisite networks, information disclosure, CSS injection, an email verification bypass, and server-side request forgery (SSRF) in URL validation.

The headline vulnerability is CVE-2026-64638 — a reflected XSS on the login screen that requires no authentication and carries the potential to lead to PHP code execution. The flaw was reported by the team at pwn.ai. Every WordPress installation running version 4.7 or higher is affected.

Also notable is the SSRF flaw in URL validation. As Patchstack noted, this is worth updating for on its own because it represents the first step in an attacker moving from compromising your WordPress site to reaching into your internal network.

WordPress 6.9 is affected by 11 of the 12 vulnerabilities addressed in this release. Patched versions are available across all supported branches: 7.0.3, 6.9.6, 6.8.7, and corresponding backports for older installations.

The wp2shell Chain: What Came Before 7.0.3

To understand the full picture, it helps to look at what was patched one release earlier. WordPress 7.0.2 addressed what researchers named wp2shell — a two-vulnerability chain that enables unauthenticated remote code execution on a default WordPress install with no plugins required.

The chain combines CVE-2026-60137, a SQL injection present in WordPress core since version 6.8, with CVE-2026-63030, a route confusion bug in the REST API batch endpoint introduced in version 6.9. Individually, each flaw is difficult to exploit. Chained together in a single HTTP request, they allow an anonymous attacker to run arbitrary code.

Exploitation began within hours of the patch release. According to researchers at watchTowr, by early Saturday morning UTC, successful exploitation was already underway — first exfiltrating hashed credentials using public exploit code, then escalating to remote code execution as additional details became public. Cloudflare telemetry and KEVIntel data identified active scanning from IP addresses across Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore.

Because of the severity, the WordPress security team enabled forced updates through its auto-update system for all sites running affected versions. John Blackbourn, a WordPress core developer, publicly recommended that affected users update immediately.

AI-Assisted Research Is Changing Vulnerability Discovery

One of the more significant storylines around both 7.0.2 and 7.0.3 is how these vulnerabilities were found. Searchlight Cyber discovered the original wp2shell chain by running OpenAI’s GPT-5.6 Sol model against WordPress core — arriving at a working pre-auth SQL injection chained all the way to remote code execution in roughly ten hours at a cost of approximately $25. That is not a research team working for weeks. That is an AI model producing exploit-grade findings in an afternoon.

The 7.0.3 release continues this pattern. The login-screen XSS credited to pwn.ai was found through their autonomous pentesting platform. The CSS injection bypass was attributed to Anthropic directly. As Patchstack observed, the chart for WordPress’s HackerOne intake tells the story clearly: nine years of monthly reports in the dozens, rising gradually this spring, jumping to 450 reports in July 2026 alone.

The practical implication for site owners is that the gap between vulnerability publication and active exploitation has shortened considerably. When AI tools can reproduce a vulnerability within minutes of public disclosure — as watchTowr confirmed with CVE-2026-63030 — the window for patching has compressed from weeks to hours.

What Multisite Operators Need to Know

WordPress multisite networks face an additional exposure. A privilege escalation bug in this release allows registered users on networks with user registration enabled to create new sites they have no business creating. This was reported by Aikido Security and does not affect standard single-site WordPress installations. If you operate a multisite network, confirm your registration settings and apply the patch before re-evaluating open registration.

What WordPress Site Owners Should Do Right Now

The steps are straightforward, but each one matters:

  1. Update to the latest version. For sites on the 7.0.x branch, that means 7.0.3. For 6.9.x, update to 6.9.6. For 6.8.x, update to 6.8.7. If you are on an older branch, either apply the latest available minor version or upgrade to 7.0.3 directly. Updates are available via Dashboard > Updates in your WordPress admin area.
  2. Check your auto-update settings. WordPress enabled forced updates for the wp2shell chain, but future critical patches may not carry that same behavior. Enabling automatic minor updates in your configuration ensures you receive security releases without a manual step.
  3. Review multisite registration. If you run a multisite network, check whether open user registration is necessary and confirm it is appropriately restricted.
  4. Audit your PHP version. The login-screen XSS in CVE-2026-64638 carries a path to PHP code execution. Running a current, actively supported PHP version (8.2 or higher) reduces your exposure surface and ensures your environment receives upstream security patches.
  5. Verify your hosting environment has applied patches. Many managed WordPress hosts and shared hosting platforms are applying patches automatically, but self-managed installations require manual action. If you are on a platform like Reclaim Cloud or a custom VPS, confirm the update has been applied.

Frequently Asked Questions

Is WordPress 7.0.3 a mandatory update?
WordPress does not enforce all security updates as forced updates, but this release addresses a pre-auth XSS with potential for PHP code execution. It is treated by the security community as a priority patch. The WordPress team recommends updating immediately.
Does wp2shell affect my site if I am already on 7.0.3?
No. The wp2shell chain (CVE-2026-60137 and CVE-2026-63030) was patched in 7.0.2 and 6.9.5. If you are on 7.0.3, both vulnerabilities are already addressed. The same applies to 6.9.6 and 6.8.7.
Does having no third-party plugins protect me from these vulnerabilities?
No. Both the wp2shell chain and CVE-2026-64638 are vulnerabilities in WordPress core itself. A stock installation with no plugins is still affected. Plugin security is a separate, ongoing concern but does not mitigate these core-level flaws.
What does this mean for ongoing WordPress maintenance?
The rise of AI-assisted security research means vulnerabilities are being discovered and exploited faster than in prior years. A consistent, proactive maintenance routine — including automatic minor updates, regular backups, and PHP version hygiene — is more important now than it was 12 months ago.

Sources:

Sources: