WordPress 7.0.3: A Cluster of Vulnerabilities Found by AI Security Tools
WordPress released version 7.0.3 on August 6, 2026, patching twelve vulnerabilities in its core software. Three of them land in the fairly serious range, with one rated High severity at 8.9 out of 10. The high-severity issue is a pre-authentication reflected cross-site scripting (XSS) flaw on the login screen that, under the right conditions, can lead to PHP code execution.
The more interesting detail isn't the vulnerabilities themselves—it's who found them. Most of these were discovered by AI security tools, including researchers from Anthropic, OpenAI's Sol Ultra model, and Patchstack's own AI pentesting teams. Oliver Sild from Patchstack called the XSS issue "the nastiest one" in a post on X, noting that while the WordPress team patched it quickly, the speed at which AI tools are finding and chaining these flaws has changed the threat landscape entirely.
WordPress is auto-updating fast, and none of these vulnerabilities appear to be mass-exploitable in the way the earlier wp2Shell chain was. But the trend matters for anyone running WordPress seriously: the window between discovery and exploitation is shrinking from days to hours.
The High-Severity XSS Flaw Explained
CVE-2026-64638, reported by the pwn.ai team, is a pre-authentication reflected XSS vulnerability on the WordPress login screen. It doesn't require any credentials to reach—the vulnerability sits on the login page itself, meaning anyone can trigger it.
Here's the catch: it doesn't spread on its own the way stored XSS does. There's no drive-by infection here. An attacker needs to craft a malicious link and get a specific person—on a specific site—to click it. If that person isn't an Administrator, the payload does nothing useful.
But if an Administrator clicks the link, things escalate quickly. The reflected XSS can lead to full remote code execution (RCE). The attacker uses specially crafted JavaScript to hijack the Admin's session, gaining the ability to load custom code or plugins onto the site. The WordPress security team confirmed this in their GitHub advisory:
"Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim."
Patchstack's Oliver Sild told Search Engine Journal they're tracking whether hackers are exploiting this flaw, but the social engineering requirement makes it unlikely to see widespread automated attacks. "Looks like the social engineering bit on the XSS that could lead to RCE is most likely not going to get much attention from the hackers," he said.
Four Stored XSS Issues from Contributor-Level Access
The next four vulnerabilities in this release all require Contributor-level or higher access. For sites with a small, select group of writers, this isn't as urgent as an unauthenticated attack. But any site with guest authors, freelance contributors, or content agencies—places where you're handing out Contributor access regularly—should update immediately.
The four stored XSS issues target different areas of the post editor:
- Emoji settings element (reported by Asaf Mozes): Stored XSS in posts via the emoji settings block.
- Post Content block (reported by n05ec): Stored XSS injected through the main post content editor.
- Quick Edit on sites with many users (reported by Naveen S and Ajmal Moochingal): Stored XSS in the Quick Edit feature, particularly impactful on sites with large user bases.
- Post Date block (reported by Alex Concha): Stored XSS in the post date field.
Four separate researchers landing four separate bugs at the same privilege level in one release cycle is worth paying attention to. Site owners should audit who they're giving Contributor access to, especially if they manage large contributor bases.
Multisite Privilege Escalation and Information Leaks
WordPress Multisite installations with user registration enabled have a privilege escalation bug that lets registered users create sites they have no business creating. Reported by Aikido Security, this only impacts Multisite setups—single-site WordPress installations can skip this one.
Three information disclosure vulnerabilities round out the more concerning issues. None of them hand an attacker the keys to your Admin Dashboard, but all of them leak data:
- The Latest Comments block exposes comments from password-protected posts (reported by HDWSec).
- Post slugs can be enumerated, giving attackers a map of your content structure (reported by HDWSec).
- Comment feeds disclose notes that were supposed to stay private (reported by Elio Gubser).
These aren't critical breaches, but they're leaking information a site owner may have intentionally kept private.
CSS Injection, Email Bypass, and SSRF
The remaining vulnerabilities in 7.0.3 include an Author+ bypass of the safe CSS attribute filter (reported by Anthropic), a way around the email address confirmation flow (reported by 0ways), and a server-side request forgery (SSRF) bug in URL validation that reaches link-local address ranges (reported by Andrew Mohawk and others).
The SSRF issue deserves particular attention for self-hosted sites. It's the first step in an attacker moving from "just your WordPress site" to "digging around in your internal network." Link-local IP ranges are reserved for internal communication within a server, and being able to reach them from outside is a significant exposure. Patchstack recommends updating over this one especially if you run your own infrastructure.
Who's Finding These Vulnerabilities Has Changed
This release highlights a shift worth understanding. The previous WordPress release, 7.0.2, patched the wp2Shell vulnerability chain (CVE-2026-60137 and CVE-2026-63030). That chain wasn't found by a human combing through the batch API line by line. Searchlight Cyber ran OpenAI's GPT-5.6 Sol Ultra model against WordPress Core and had a working pre-auth SQL injection, chained all the way to RCE, in ten hours. Total cost: about $25.
Now look at 7.0.3. The XSS-to-RCE vulnerability is credited to pwn.ai and their "autonomous pentesting" efforts. The Author+ CSS injection comes directly from Anthropic. Aikido Security found the Multisite privilege escalation. These aren't human-assisted discoveries anymore—the models find the vulnerabilities, chain them to exploitation, and all the researcher needs to do is report it.
The numbers back this up. WordPress's HackerOne intake shows nine years of monthly reports staying in the dozens, with report counts picking up sharply this spring and hitting 450 in July alone. That's John Blackbourn's data, tracking WordPress Core, .org infrastructure, and official plugins.
More advanced models like GPT-5.6 Sol are coming into widespread use for security research, and the results speak for themselves. None of that is bad news on its own—more eyes on the codebase, faster, is a good thing for WordPress and other open source projects long-term. But it means old assumptions about the speed of finding vulnerabilities (and the speed to exploit them) don't hold anymore.
If a model can go from zero to working RCE in ten hours, the disclosure-to-exploit window isn't measured in days. It's measured in hours. Update to 7.0.3 today, regardless. But if research is moving this fast, "we'll patch it during a maintenance window" is a plan built for a threat landscape that's already gone.
Backporting and Remediation
WordPress released version 7.0.3 on August 6, 2026, and patched all twelve vulnerabilities. As a courtesy to users on older branches, the fixes have been backported to all WordPress versions going back to 4.7. Patchstack deployed RapidMitigate rules for the high-risk vulnerabilities immediately, and Oliver Sild confirmed that Patchstack customers received mitigation rules right at disclosure.
WordPress is auto-updating fast, which helps mitigate the risk for the vast majority of sites. But self-hosted installations, enterprise deployments, and Multisite networks should prioritize this update, especially given the SSRF and privilege escalation issues that affect specific configurations.
Source
This article draws on coverage from Search Engine Journal, which reported on the twelve WordPress core vulnerabilities patched in version 7.0.3, including the high-severity pre-auth XSS on the login screen rated 8.9/10. The article also features commentary from Patchstack's Oliver Sild on the role of AI security tools—including @AnthropicAI, @pwn_ai, and @AikidoSecurity—in discovering these vulnerabilities.
Source
Patchstack's own advisory provides detailed breakdowns of each vulnerability, including technical descriptions of the XSS-to-RCE chain, the four Contributor-level stored XSS issues, the Multisite privilege escalation, and the SSRF flaw. The advisory also documents the role of AI security tools in discovering these flaws and provides context on Patchstack's RapidMitigate response."
