WordPress 7.0.3 release  🔗 **Source:** [WordPress 7.0.3 release](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/) > [!note]+ Document Notes > --- > tags: [wordpress-7-0, security-release, maintenance-release, xss, ssrf, multisite] > author: WordPress.org > source: WordPress.org News > reference: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ > date created: 2026-08-06 17:21 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > # 🏷️ Title: WordPress 7.0.3 release > ## 🧭 Table of Contents > - Summary > - Main Content > - Notes > - References > - Paraphrase > - Newsletter > - Action Items > - Hypotheses > - Methodology > - Questions > - Future Research > - Implications > - Learning Styles Assessment > - Accessibility Assessment > - DEIB Assessment > - Logical Validity > - DARVO Analysis > - Conclusion > - Refactor Appendix > ### 🔗 References > - https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ > - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf > ## 📝 Summary > - What happened: WordPress 7.0.3 shipped as a security release. > - Why it matters: site owners should update immediately, and operators should understand the listed vulnerability classes and backport status. > - Stakeholders: site owners, hosts, agencies, plugin/theme developers, security researchers, WordPress Security Team. > - Risks and tradeoffs: only the latest WordPress version is actively supported, while backports are provided where needed for eligible branches. > - Bottom line: update to 7.0.3, track backports, and note that WordPress 7.1 RC2 includes applicable fixes. > ## 📖 Main Content > The release includes multiple security fixes: pre-auth reflected XSS on login with potential path to PHP code execution, several Contributor+ stored XSS issues, multisite privilege escalation, information disclosure in Latest Comments, Author+ CSS injection, and SSRF in URL validation. The post thanks reporters and contributors, names the release lead, and links details for CVE-2026-64638 / GHSA-52p2-r8wf-jcrf. > The operational message is simple: update now, and let automatic background updates run where supported. The strategic message is also important: backports exist for eligible branches, but only the most recent version is actively supported. > ## 🗒️ Notes > - Security release, not feature release. > - WordPress 7.1 RC2 contains applicable fixes. > - Vulnerability classes include XSS, privilege escalation, information disclosure, CSS injection, and SSRF. > - Backports are in progress for eligible security branches through 4.7. > ## 📚 References > - Release post: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ > - Advisory: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf > ## 🗣️ Paraphrase > WordPress 7.0.3 is available and site owners should update right away. The release fixes several security issues and gives credit to researchers and contributors. Older eligible branches will receive backports where needed, but active support remains focused on the newest version. > ## 📰 Newsletter > WordPress 7.0.3 is out with security fixes, and the advice is the usual but important kind: update now. The release covers XSS, multisite privilege escalation, information disclosure, CSS injection, and SSRF, with 7.1 RC2 also carrying applicable fixes. If you manage sites, this is an operations item, not a someday item. > ## ✅ Action Items > #### DevRel > - Publish plain-language update guidance for agencies and site owners. > - Explain why backports do not equal active support for old branches. > #### OSPO > - Track CVE/GHSA identifiers, reporter credits, and backport status. > - Update SBOM and supported-version policies. > #### Community > - Help local groups share calm update instructions. > - Thank reporters without exposing sensitive exploit details. > #### WordPress > - Core: monitor regressions from 7.0.3 and 7.1 RC2 fixes. > - Core Performance: watch patch impact. > - Core AI: test AI summaries for exact vulnerability scope. > - Core Program Team: coordinate release communications. > - Mobile: confirm app/API paths are unaffected or patched. > - Playground: provide update-test environments. > - Community: share update guidance. > - Training: teach responsible update practices. > - Marketing: avoid panic and keep facts crisp. > - Support: prepare FAQ and troubleshooting. > - Design: no direct action. > - Documentation: update version pages and security notes. > - Photos: no direct action. > - TV: no direct action. > - Polyglots: translate security guidance. > - Accessibility: ensure update notices are readable. > - Meta: maintain release and advisory links. > - CLI: verify `wp core update` guidance. > - Hosting: roll out managed updates and monitor failures. > - Tide: monitor ecosystem impact. > - Openverse: no direct action. > - Themes: test compatibility. > - Plugins: test compatibility and security interactions. > #### The WPOCC > - Support public security literacy for small site operators. > ### FAIR > - Security advisories need public provenance, credits, and version clarity. > ## 🧪 Hypotheses > - Clear update guidance increases patch completion speed. > - Hosts with automatic updates reduce exposure windows for security releases. > - Linking an advisory improves technical trust while protecting sensitive details. > ### 📊 Methodology > - Track update adoption across managed and unmanaged sites. > - Monitor support forums for regressions. > - Compare update timing before and after translated advisories. > ### ❓ Questions > - Which fixes are backported to which branches and when? > - What regressions, if any, appear after 7.0.3? > - How widely is automatic background updating enabled? > ### 🔮 Future Research > - Study security-release adoption by host type. > - Compare public advisory timing and exploit attempts. > - Build clearer unsupported-version messaging. > ### 💡 Implications > - Practice: update immediately and verify site health. > - Policy: latest-version support should be clearly communicated. > - Security: XSS and SSRF classes require active monitoring. > - Education: site owners need calm, exact instructions. > - Funding: support security team capacity and researcher coordination. > ### 🧠 Learning Styles Assessment > - Reading level estimate: grade 9-10. > #### 👀 Visual learners > - Present: list of issues. > - Improve: affected-version/backport table. > #### 🔊 Aural learners > - Present: no audio. > - Improve: short update explainer. > #### 🗣️ Verbal learners > - Present: clear release prose. > - Improve: glossary for XSS and SSRF. > #### ✋ Kinesthetic learners > - Present: update instructions. > - Improve: WP-CLI command examples. > #### 🧮 Logical learners > - Present: vulnerability list and advisory link. > - Improve: severity and affected-scope matrix. > #### 👥 Social learners > - Present: contributor credits. > - Improve: office-hours guidance. > #### 🧍 Solitary learners > - Present: standalone update post. > - Improve: self-checklist. > #### 🌿 Naturalistic learners > - Present: release lifecycle context. > - Improve: branch support map. > ### 📊 Accessibility Assessment > #### Perceivable > - Text carries all key information. > #### Operable > - Links and dashboard route are clear. > #### Understandable > - Mostly clear; vulnerability terms need definitions for non-specialists. > #### Reliable parsing > - Reader capture is intact. > #### Cognitive load > - Moderate due to long credit list. > #### Low vision > - No image dependency. > #### WCAG 2.2 AA fit > - Likely acceptable; not fully audited. > ### 🌍 DEIB Assessment > #### Cultural breadth > - Global site-owner audience. > #### Inclusive language > - Neutral and credit-giving. > #### Neurodiversity support > - Would benefit from a compact checklist. > #### Representation > - Reporter and contributor credits are visible. > #### Psychological safety > - Calm, urgent, non-shaming. > ### ✅ Logical Validity > #### Strong reasoning > - Security release status supports immediate-update advice. > #### Fallacies > - No major fallacy. Possible authority shortcut if users update without backup/testing; fix by pairing update advice with verification. > #### Tone of voice > - Urgent, factual, appreciative. > ### 🛡️ DARVO Analysis > - Not applicable. > ## 🎯 Conclusion > This is a must-act operations note. Update to WordPress 7.0.3, watch for backports and regressions, and recor WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by [downloading it from WordPress.org](https://wordpress.org/wordpress-7.0.3.zip), or visiting your site’s Dashboard → Updates and clicking **Update Now**. Sites that support automatic background updates will begin updating shortly. For more information, please visit the [WordPress 7.0.3 HelpHub site](https://wordpress.org/documentation/wordpress-version/version-7-0-3/). The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release: * Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at [pwn.ai](https://pwn.ai/). * Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes ([amosec](https://hackerone.com/amosec?type=user)) * Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by [n05ec](https://hackerone.com/n05ec) * Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by [Naveen S](https://www.linkedin.com/in/naveens72/) and [Ajmal Moochingal](https://www.linkedin.com/in/ajmalmoochingal/) * Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by [Alex Concha](https://profiles.wordpress.org/xknown/) of the WordPress Security Team * A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by [Aikido Security](https://aikido.dev/) * An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by [Ehtisham Siddiqui](https://profiles.wordpress.org/ehtis/) of the WordPress Security Team * Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic * A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by [Andrew Mohawk](https://hackerone.com/andrewmohawk?type=user) and multiple independent reporters As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, **only the most recent version of WordPress is actively supported**. The backports are in progress and will ship as they become ready. WordPress 7.1 RC2 has also been released, containing all applicable fixes. Details of the login screen XSS vulnerability can be found in the advisory: [CVE-2026-64638 / GHSA-52p2-r8wf-jcrf](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf). This release was led by [John Blackbourn](https://profiles.wordpress.org/johnbillion/). In addition to the security researchers mentioned above, WordPress 7.0.3 and its backports would not have been possible without the significant contributions of the following people: [Aaron D. Campbell](https://profiles.wordpress.org/aaroncampbell), [Aaron Jorbin](https://profiles.wordpress.org/jorbin), [Adam Silverstein](https://profiles.wordpress.org/adamsilverstein), [adrianmoldovanwp](https://profiles.wordpress.org/adrianmoldovanwp), [Aki Hamano](https://profiles.wordpress.org/wildworks), [Alex Concha](https://profiles.wordpress.org/xknown), [Andrew Duthie](https://profiles.wordpress.org/aduth), [Andrew Serong](https://profiles.wordpress.org/andrewserong), [annezazu](https://profiles.wordpress.org/annezazu), [Barry](https://profiles.wordpress.org/barry), [Bernie Reiter](https://profiles.wordpress.org/bernhard-reiter), [Daniel](https://profiles.wordpress.org/villanovachile), [Daniel Richards](https://profiles.wordpress.org/talldanwp), [David Biňovec](https://profiles.wordpress.org/davidbinda), [Dennis Snell](https://profiles.wordpress.org/dmsnell), [Ehtisham Siddiqui](https://profiles.wordpress.org/ehtis), [Erwan Le Rousseau](https://profiles.wordpress.org/erwanlr), [Fabian Kaegy](https://profiles.wordpress.org/fabiankaegy/), [fiocavallari](https://profiles.wordpress.org/fiocavallari), [George Mamadashvili](https://profiles.wordpress.org/mamaduka), [gubser](https://profiles.wordpress.org/odkdn1), [Isabel Brison](https://profiles.wordpress.org/isabel_brison), [Jarda Snajdr](https://profiles.wordpress.org/jsnajdr), [Jb Audras](https://profiles.wordpress.org/audrasjb), [Jeremy Felt](https://profiles.wordpress.org/jeremyfelt), [Joe Dolson](https://profiles.wordpress.org/joedolson), [Joe Hoyle](https://profiles.wordpress.org/joehoyle), [John Blackbourn](https://profiles.wordpress.org/johnbillion), [Jon Surrell](https://profiles.wordpress.org/jonsurrell), [Jonathan Desrosiers](https://profiles.wordpress.org/desrosj), [Khokan Sardar](https://profiles.wordpress.org/khokansardar), [Lance Willett](https://profiles.wordpress.org/lancewillett), [lucasbustamante](https://profiles.wordpress.org/lucasbustamante), [lucatume](https://profiles.wordpress.org/lucatume), [Marco Ciampini](https://profiles.wordpress.org/mciampini/), [Marin Atanasov](https://profiles.wordpress.org/tyxla), [Mohammad Jangda](https://profiles.wordpress.org/batmoo), [Mukesh Panchal](https://profiles.wordpress.org/mukesh27), [Paul Kevan](https://profiles.wordpress.org/paulkevan), [Peter Wilson](https://profiles.wordpress.org/peterwilsoncc), [ramonopoly](https://profiles.wordpress.org/ramonopoly), [SergeyBiryukov](https://profiles.wordpress.org/sergeybiryukov), [vortfu](https://profiles.wordpress.org/vortfu), [Weston Ruter](https://profiles.wordpress.org/westonruter) [](https://us.wordcamp.org/2026/)Join us for the launch of WordPress 7.1 at [WordCamp US 2026](https://us.wordcamp.org/2026/), August 16–19., WordPress 7.0.3 release, WordPress.org, 01kzcf3abz5dgkphqyj53et3ev.