WordPress released version 7.0.3 on August 6, patching twelve vulnerabilities in core software. One of them is rated 8.9 out of 10 and classified as high severity: a pre-authentication reflected cross-site scripting (XSS) flaw affecting the login screen, a vulnerability class that lets an attacker’s injected script run inside a legitimate user’s browser session. Pre-authentication means the attacker needs no WordPress account to attempt the exploit, and that detail carries a stake beyond the code itself. A compromised WordPress install is a search problem before it is anything else: the risk class behind an unauthenticated exploit like this one includes injected spam pages, hacked-content flags, and lost rankings, the kind of damage that follows a site takeover rather than a data breach alone. WordPress backported the fix to every branch back to version 4.7, so sites running years-old core versions are covered without a full upgrade.
WordPress’s GitHub security advisory describes the mechanism directly. A specially crafted malicious third-party website can escalate the reflected XSS “to an RCE vulnerability with conditions outside of the attackers control,” but only if the exploit succeeds at “social engineering of and explicit interaction by the target victim.” In practice, an attacker still needs to trick a logged-in user into visiting a hostile page and taking an action there. That requirement is the one factor standing between a high-severity rating and a mass-exploitable one.
Patchstack’s Oliver Sild, whose firm helped disclose the issue, called it the standout risk in the release. “The nastiest one is a login screen XSS, which via some social engineering could lead to Remote Code Execution,” Sild wrote on X, adding that “none of the vulnerabilities are mass-exploitable” the way a prior core flaw known as WP2Shell was. Sild told Search Engine Journal his firm is tracking exploitation attempts but expects limited hacker interest, since the social-engineering step needed to reach RCE raises the cost of an attack. Sild also credited the discoveries to security researchers at Anthropic, pwn_ai, and Aikido Security, among others, a detail that fits a pattern Search Engine Journal’s Roger Montti flagged: WordPress core vulnerability discoveries have clustered unusually in recent weeks, aided by AI.
WordPress’s own announcement does not close every gap it opens. The advisory assigns the pre-auth XSS a severity score but supplies no comparable rating or detail for most of the other eleven fixes. Two stand out even without a score: a server-side request forgery issue that lets URL validation be tricked into contacting link-local IP ranges, and a multisite privilege-escalation bug that lets a registered user create a new site on a network without authorization. Both could matter for institutional and multi-site installs, but neither carries a documented severity assessment in the source advisory.
Search teams running WordPress should treat 7.0.3 as a same-week update rather than a routine one, given the flaw requires no attacker account and the backport already covers legacy branches back to 4.7. Confirm auto-update has applied the patch, and audit login-page customizations or third-party plugins that render user-supplied content on that screen, since those are the surfaces a reflected XSS depends on.
Search Engine Journal, in a report by Roger Montti published August 6, 2026.
