For more information, please visit the WordPress 7.0.3 HelpHub site<\/a>.<\/p>\n\n\n\n The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release:<\/p>\n\n\n\n As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported<\/strong>. The backports are in progress and will ship as they become ready.<\/p>\n\n\n\n WordPress 7.1 RC2 has also been released, containing all applicable fixes.<\/p>\n\n\n\n Details of the login screen XSS vulnerability can be found in the advisory: CVE-2026-64638 \/ GHSA-52p2-r8wf-jcrf<\/a>.<\/p>\n\n\n\n This release was led by John Blackbourn<\/a>. In addition to the security researchers mentioned above, WordPress 7.0.3 and its backports would not have been possible without the significant contributions of the following people: WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard \u2192 Updates and clicking Update Now. Sites that support […]<\/p>\n","protected":false},"author":42547,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","podmotor_file_id":"","podmotor_episode_id":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","filesize_raw":"","date_recorded":"","explicit":"","block":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false},"categories":[14,15],"tags":[437,409],"class_list":["post-21327","post","type-post","status-publish","format-standard","hentry","category-releases","category-security","tag-minor-releases","tag-releases"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pZhYe-5xZ","_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/21327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/42547"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=21327"}],"version-history":[{"count":7,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/21327\/revisions"}],"predecessor-version":[{"id":21339,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/21327\/revisions\/21339"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=21327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=21327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=21327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Security updates included in this release<\/h2>\n\n\n\n
\n
Backports<\/h2>\n\n\n\n
CVE and GHSA references<\/h2>\n\n\n\n
Thank you to these WordPress contributors<\/h2>\n\n\n\n
Aaron D. Campbell<\/a>, Aaron Jorbin<\/a>, Adam Silverstein<\/a>, adrianmoldovanwp<\/a>, Aki Hamano<\/a>, Alex Concha<\/a>, Andrew Duthie<\/a>, Andrew Serong<\/a>, annezazu<\/a>, Barry<\/a>, Bernie Reiter<\/a>, Daniel<\/a>, Daniel Richards<\/a>, David Bi\u0148ovec<\/a>, Dennis Snell<\/a>, Ehtisham Siddiqui<\/a>, Erwan Le Rousseau<\/a>, Fabian Kaegy<\/a>, fiocavallari<\/a>, George Mamadashvili<\/a>, gubser<\/a>, Isabel Brison<\/a>, Jarda Snajdr<\/a>, Jb Audras<\/a>, Jeremy Felt<\/a>, Joe Dolson<\/a>, Joe Hoyle<\/a>, John Blackbourn<\/a>, Jon Surrell<\/a>, Jonathan Desrosiers<\/a>, Khokan Sardar<\/a>, Lance Willett<\/a>, lucasbustamante<\/a>, lucatume<\/a>, Marco Ciampini<\/a>, Marin Atanasov<\/a>, Mohammad Jangda<\/a>, Mukesh Panchal<\/a>, Paul Kevan<\/a>, Peter Wilson<\/a>, ramonopoly<\/a>, SergeyBiryukov<\/a>, vortfu<\/a>, Weston Ruter<\/a><\/p>\n\n\n\n![\"WordCamp](\"https:\/\/i0.wp.com\/wordpress.org\/news\/files\/2026\/06\/wcus-2026-teaser.png?resize=1024%2C321&ssl=1\")
<\/a>