On August 6, 2026, WordPress pushed version 7.0.3 — a security-only release with no feature changes. If you're still running 7.0.2 because you figured the WP2Shell patch had you covered, keep reading. This one is different, and the worst bug in the batch lives on the one page every WordPress site shows to the entire internet: the login screen.
CVE-2026-64638: The Login Screen Flaw
The headline fix is CVE-2026-64638, a reflected cross-site scripting vulnerability on wp-login.php that requires zero authentication to trigger. The security team at pwn.ai discovered it and gave it a CVSS score of 8.9.
Here's the short version: when someone enters a bad username and WordPress shows the "incorrect password" error, the username value passes through sanitize_user() and wp_strip_all_tags(). That second function relies on PHP's strip_tags(), which has a known quirk — a tag-like string with whitespace after the opening < survives the parser as plain text. Later, WordPress runs the same value through wp_kses_post(), which has its own HTML parser and interprets that same input as permitted markup. The result is attacker-controlled DOM elements rendered directly on the login page.
From there, the researchers chained it further. WordPress loads user-profile.js on the login page (because the page handles password resets), and that script expects certain DOM elements that aren't present. Two missing inputs resolve to undefined, letting an equality check pass. An attacker can clobber the undefined ajaxurl variable with an injected DOM element, steering WordPress's own JavaScript toward an attacker-controlled same-origin REST request.
Using WordPress's REST JSONP support, that request becomes executable JavaScript in the site's origin. For setups where anonymous REST calls return 401, the _envelope=1 parameter wraps the denial in an HTTP 200 response, letting jQuery process it as script anyway.
From XSS to Server Compromise
pwn.ai demonstrated a path from this XSS all the way to PHP code execution. The technique borrows from Paulos Yibelo's 2022 Same Origin Method Execution research. The injected script invokes WordPress's Application Password approval flow inside a logged-in administrator's session — no password theft needed, just one click on an attacker-controlled page. WordPress creates an API credential and sends it to the attacker's HTTPS endpoint.
With that credential, the attacker publishes a WordPress page containing same-origin JavaScript. When the still-logged-in administrator's browser loads that page, the script grabs the plugin-upload nonce and installs an attacker-supplied ZIP. The plugin doesn't even need to be activated — PHP executes on request from the extracted files.
The researchers noted that a nonce-based Content Security Policy with strict-dynamic did not block their demonstrated path.
What Else Is in 7.0.3
The login XSS is the scariest one, but it's not alone. WordPress 7.0.3 patches twelve security issues total:
Stored XSS flaws affecting Contributor-level accounts and above — in the Post Content block, the emoji settings element, Quick Edit (on sites with lots of users), and the Post Date block. If you run a multi-author site, these matter.
Privilege escalation on multisite — a user with registration enabled could create a new site on the network without proper authorization. Aikido Security reported this one.
Information disclosure in Latest Comments block — comments on password-protected posts were leaking through the block. Not catastrophic, but sloppy.
Post slug enumeration and comment feed notes disclosure — two separate issues that let attackers map your content structure and internal notes.
SSRF in URL validation — requests to link-local ranges slipped through. Andrew Mohawk and multiple independent reporters caught this.
CSS injection bypass — an Author-level user could inject CSS by bypassing the safe attribute filter. Anthropic's security team found this one, which is interesting.
Email confirmation bypass — someone figured out how to skip the email address confirmation flow entirely.
What You Should Do
If automatic background updates are enabled on your site, you probably already have 7.0.3. Check anyway — go to Dashboard → Updates and verify.
If you're managing sites manually or running a hosting setup that doesn't auto-update core, this is a drop-everything-and-update situation. The login page XSS affects every version of WordPress, and the fixes are being backported through the 4.7 branch. Anything older than 4.7 is out of luck.
For agencies and freelancers managing client sites: the WP2Shell post from two weeks ago already had people patching to 7.0.2. This is the follow-up. Don't assume 7.0.2 is enough — it isn't.
And if you're running WordPress multisite with user registration enabled, the privilege escalation fix alone justifies the update.
The full details are in the WordPress 7.0.3 release post and the CVE-2026-64638 advisory. The pwn.ai write-up on the XSS2Shell chain is worth reading if you want the technical depth.