WordPress 7.0.3: The Security Fix You Shouldn’t Put Off

On 6 August 2026, WordPress released version 7.0.3, a security update that patches 12 vulnerabilities, three of which are considered serious. This is not an update you should put off: if your site does not update automatically, now is the time to check.

What it actually fixes (in plain terms)

The official changelog lists twelve fixes, but only a few are relevant to a typical site. Here are the three you need to know about:

• XSS on the login screen (high severity, 8.9/10): an attack that doesn’t even require an account on the site. Under certain conditions, it can lead to PHP code execution. This is the most serious issue in this release.
• SSRF in URL validation: allows the server to be tricked into making requests to internal network addresses (link-local). On its own, it does not ‘break into’ the site, but it is often the first step in moving from an external attack into the server’s internal network.
• Privilege escalation on multisite networks: where user registration is enabled, a user may end up creating a new site on the network. This affects multisite installations only; it does not affect single sites.

The rest are minor fixes: information disclosure (comments on password-protected posts were exposed via the ‘Latest Comments’ block), post slug enumeration, and a bypass in the email confirmation process. Good to know, but not urgent.

Is my site at risk?

Yes, if you’re running a version prior to 7.0.3 and haven’t enabled automatic updates. The fix has been backported all the way to version 4.7, so sites on older branches also have an update available: 6.9.6, 6.8.7, 6.7.6, 6.6.6, and so on, depending on which branch you’re running.

If your host has automatic core updates enabled, you’re likely already patched without having done anything. If you’re not sure, that’s the first thing to check.

What to do now

1. Go to Dashboard → Updates and check your installed WordPress version.
2. If you’re running a version earlier than 7.0.3 (or earlier than the patched version of your branch), update immediately, manually if necessary.
3. As always, take a backup before updating, even if it’s ‘just’ a security patch.
4. If you run a multisite network with open user registration, check the logs for any suspicious site-creation activity over the past few days.

If you manage several WordPress sites (agency, e-commerce, portals) and want to ensure the update has been applied across the board without having to manually check every installation, that’s exactly the sort of task that managed maintenance covers.