WordPress has officially released **WordPress 7.0.3**, a mandatory security-only update designed to patch 12 security issues. The headline vulnerability—tracked as **CVE-2026-64638**—is a high-severity pre-authentication reflected Cross-Site Scripting (XSS) vulnerability located on the WordPress login screen.

Because this vulnerability can be exploited under specific conditions to achieve Remote Code Execution (RCE), all WordPress administrators and website owners are strongly advised to update their sites to version 7.0.3 immediately.

---

### Vulnerability Breakdown

#### 1. High-Severity Reflected XSS on Login Page (CVE-2026-64638)

* **Vulnerability Type:** Pre-authentication Reflected Cross-Site Scripting (XSS)
* **CVSS Score:** 8.9 (High)
* **Affected Versions:** WordPress 4.7.0 through 7.0.2
* **Impact:** An attacker can craft a malicious link targeting the `/wp-login.php` route. If an authenticated administrator clicks the link, the attacker can execute arbitrary JavaScript in the context of the admin's session. By abusing built-in WordPress administrative tools (such as the plugin or theme editor), this session hijacking can be escalated to arbitrary PHP code execution on the server.

#### 2. Additional Security Patches Included in 7.0.3

Along with CVE-2026-64638, WordPress 7.0.3 resolves 11 additional security flaws:

* **Stored XSS Vulnerabilities:** Four separate stored XSS issues requiring Contributor-level access or higher (located in the Post Content block, Post Date block, Emoji settings, and Quick Edit).
* **Privilege Escalation:** An issue in WordPress Multisite installations where registered users could create sites beyond their assigned role permissions.
* **Server-Side Request Forgery (SSRF):** A flaw in URL validation that could allow external requests to reach internal/link-local IP address ranges.
* **Data Exposure Flaws:** Information disclosure vulnerabilities affecting password-protected post comments, post slug enumeration, and private comment feeds.
* **Filter Bypasses:** Safe CSS attribute filter bypass (Author+) and email verification bypass.

---

### Am I Affected?

If your site is running any version of WordPress between **4.7 and 7.0.2**, your installation contains unpatched core files. Older branch versions (such as 6.9, 6.8, etc.) have also received corresponding point security releases.

---

### Recommended Action

#### For Managed Hosting Clients

If your site is hosted on a managed infrastructure platform with automatic core update enforcement enabled, your WordPress installation will be patched automatically to version 7.0.3. No manual intervention is required, though verifying your site version after deployment is recommended.

#### For Self-Managed Installations

1. Log into your **WordPress Dashboard**.
2. Navigate to **Dashboard → Updates**.
3. Click **Update Now** to upgrade to WordPress 7.0.3 immediately.
4. Alternatively, download the release package directly from [WordPress.org Release Announcement](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/) and deploy via CLI (`wp core update`) or Plesk Filemanager.

*Note: Always take a complete site and database backup prior to applying core software updates.*.