WordPress 7.0.3 Security Update: SSRF, XSS, Privilege Escalation

Vulnerability Overview WordPress version 7.0.3 has been released, containing multiple security fixes. The primary vulnerabilities include: 1. Pre-authentication Reflected Cross-Site Scripting (XSS): A reflected XSS vulnerability exists on the login screen that could potentially lead to PHP code execution, reported by the team. 2. Contributor+ Stored Cross-Site Scripting (XSS): XSS stored via the emoji setting element in posts, reported by Asaf Mozes (amossec). 3. Contributor+ Stored Cross-Site Scripting (XSS): XSS stored in the Post Content block, reported by n05ec. 4. Contributor+ Stored Cross-Site Scripting (XSS): XSS stored via Quick Edit, reported by Naveen S and Almal Moochingal. 5. Contributor+ Stored Cross-Site Scripting (XSS): XSS stored in the Post Date block, reported by Alex Concha. 6. Privilege Escalation Issue: On multisite networks with user registration enabled, allows users to create new sites, reported by Aikido Security. 7. Information Disclosure: Comments on password-protected posts exposed in the Recent Comments block, reported by Ehtisham Siddiqui. 8. Post Slug Enumeration: Reported by HDWSec. 9. Comment Note Disclosure: Reported by Elio Gubser. 10. Author CSS Injection: Bypassing secure CSS attribute filters, reported by Anthropic. 11. Email Address Confirmation Process Bypass: Reported by Dways. 12. Server-Side Request Forgery (SSRF): URL validation allows requests to link-local scope, reported by Andrew Mohawk and other independent researchers. Scope of Impact WordPress 7.0.3: All websites installed with this version. WordPress 7.1 RC2: Released, containing all applicable fixes. WordPress 4.7 and earlier versions: No longer supported, but some fixes have been backported. Remediation Update Immediately: All users are advised to update to WordPress 7.0.3 or a later version immediately. Manual Update: Updates can be performed by downloading from WordPress.org or by visiting the site dashboard and clicking the "Update" button. Automatic Update: Sites supporting automatic background updates will begin updating shortly. Additional Information CVE and GHSA References: Details regarding the login screen XSS vulnerability can be found in CVE-2026-64638 / GHSA-52p2-r8wf-icrf. Contributors: Thanks to all individuals who reported vulnerabilities and contributed to the fixes. Code Blocks No specific Proof of Concept (PoC) code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress 7.0.3 Security Update: SSRF, XSS, Privilege Escalation