Short answer: if your WordPress site hasn’t updated to version 7.0.3 (or the matching patched point release for your branch) yet, it’s carrying a high-severity, pre-authentication security vulnerability that doesn’t require an attacker to be logged in to exploit. Here’s exactly what it is, whether you’re affected, and how to check in under two minutes.
What WordPress 7.0.3 actually fixes
Released August 6, 2026, this update patches 12 separate security issues. The one to actually worry about carries a CVE (CVE-2026-64638) with a High severity rating — a pre-authentication reflected cross-site scripting vulnerability on the WordPress login screen, which WordPress’s own advisory says has the potential to lead to PHP code execution through the plugin and theme editor.
“Pre-authentication” is the key phrase here. It means an attacker doesn’t need any existing account or login on your site for this to be exploitable — that’s what separates this from a routine patch and makes it worth acting on today, not “sometime this week.”
The release also fixes a privilege escalation issue on multisite networks, plus several additional stored XSS bugs elsewhere in WordPress core.
Am I affected if I’m not running WordPress 7.0?
Yes, most likely. Because of how serious this is, WordPress backported the fix to every supported branch going back to version 4.7. If you’re intentionally running an older major version for plugin or theme compatibility reasons, there’s almost certainly a patched point release for your specific branch — check your exact version number against WordPress’s own release notes rather than assuming you’re safe just because you’re not on 7.0.
How to check your site right now
- Log into your WordPress dashboard
- Go to Dashboard → Updates
- Confirm your version reads 7.0.3, or the correct patched release for your branch (e.g. 6.9.x, 6.8.x — check WordPress.org’s release notes for your exact branch’s patched number)
- If it doesn’t match, click Update Now immediately
Because of the severity, WordPress.org enabled forced auto-updates for affected versions — so there’s a real chance your site already patched itself in the background. Still worth the thirty seconds to confirm directly rather than assume.
Do I need to do anything else after updating?
No special precautions. This is a security-only release with no database schema changes, so your normal backup routine covers you — there’s nothing extra to prepare before applying it, and no reason to delay for testing the way you might with a major feature update.
The bottom line
A pre-authentication, high-severity vulnerability on the login screen is about as close as WordPress security releases get to “stop what you’re doing and check now.” If you manage more than one WordPress site, it’s worth running through the same two-minute check on each one today.
While you’re checking your login screen, it’s worth pairing this update with the broader steps in our guide on defending WordPress against brute force and XML-RPC attacks — patching this specific vulnerability closes one door, but login-screen security is worth hardening beyond just staying updated.