Overview
- WordPress released version 7.0.3 on Thursday, August 6, 2026, and backported the fixes to supported branches as far back as 4.7 to address twelve vulnerabilities.
- The most serious flaw, tracked as CVE‑2026‑64638 with a CVSS score of 8.9, is a reflected cross‑site scripting (XSS) on the login page that needs no attacker account to trigger.
- Researchers at pwn.ai demonstrated a lab exploit called XSS2Shell that chains the login XSS into server‑side PHP execution by abusing DOM clobbering, same‑origin REST/JSONP behavior, and Application Password flows.
- WordPress says escalation to remote code execution depends on social engineering and explicit admin interaction, and as of August 7 there are no confirmed reports of active exploitation in the wild.
- The release also fixes an SSRF that could reach link‑local ranges and a multisite registration privilege escalation, and administrators are urged to apply the update or confirm automatic background updates have installed it.