WordPress 7.0.3 was released on August 6, 2026, bringing an important collection of security fixes to WordPress websites.
Unlike a typical maintenance update focused primarily on bugs or minor improvements, WordPress 7.0.3 is a security release. The WordPress Security Team is recommending that website owners update their sites immediately.
For business owners using WordPress, this is an update worth paying attention to.
At 616 Marketing Group, we have been building, hosting, updating, and maintaining WordPress websites since WordPress 3.0.2 in 2010. One of the biggest lessons from managing WordPress websites over that time is simple:
Website maintenance is not something you want to ignore until something breaks.
Here’s what changed in WordPress 7.0.3, why the security fixes matter, and what business owners should do next.
What Is WordPress 7.0.3?
WordPress 7.0.3 is the latest security release for WordPress 7.0 “Armstrong.”
It follows the original WordPress 7.0 release from May 2026 and subsequent updates to the 7.0 branch.
WordPress 7.0.3 does not introduce a major collection of new design tools or features. Instead, its purpose is more important behind the scenes: closing security vulnerabilities discovered in WordPress Core.
The update addresses 12 security vulnerabilities, including cross-site scripting vulnerabilities, information disclosure issues, privilege escalation, server-side request forgery, and other security concerns.
What Security Issues Does WordPress 7.0.3 Fix?
The security fixes affect several different areas of WordPress.
According to the official WordPress release documentation, WordPress 7.0.3 addresses:
- A pre-authentication reflected cross-site scripting (XSS) vulnerability on the WordPress login screen with the potential to lead to PHP code execution
- Multiple stored XSS vulnerabilities affecting areas including the Post Content block, Post Date block, emoji settings, and Quick Edit
- A privilege escalation issue affecting WordPress Multisite networks with user registration enabled
- An information disclosure issue involving comments on password-protected posts
- A server-side request forgery (SSRF) vulnerability involving URL validation
- An issue allowing enumeration of post slugs
- Disclosure of notes through comment feeds
- A CSS injection vulnerability
- A bypass involving the email address confirmation process
For the average small business owner, those descriptions can sound highly technical.
The takeaway is much simpler:
These are security vulnerabilities in WordPress Core, and the fixes are already available.
Leaving a website on an affected version unnecessarily leaves known vulnerabilities unpatched.
One Vulnerability Is Especially Important
One of the more serious fixes involves a pre-authentication reflected XSS vulnerability on the WordPress login screen.
“Pre-authentication” is important because it means exploitation does not necessarily require an attacker to already have a WordPress account.
WordPress reports that this vulnerability had the potential to lead to PHP code execution. The issue is identified as CVE-2026-64638 / GHSA-52p2-r8wf-jcrf.
That is one of the reasons WordPress isn’t treating 7.0.3 as an update website owners should simply get around to eventually.
Their recommendation is to update immediately.
Does WordPress 7.0.3 Affect Older WordPress Websites?
Yes.
The vulnerabilities addressed by this release are not limited exclusively to websites already running WordPress 7.0.
WordPress has released security fixes for affected older branches as well. For example, WordPress states that version 6.9 is affected by 11 of the 12 vulnerabilities, while WordPress 6.8 through several earlier releases are affected by many of them. Security releases have been made available for affected versions going back through WordPress 4.7.
However, there is an important distinction.
WordPress states that only the most recent version of WordPress is actively supported. Older security releases are provided as a courtesy.
If your business website is running a significantly outdated version of WordPress, simply installing one backported security patch should not necessarily be considered a long-term maintenance strategy.
An outdated WordPress installation may also mean outdated plugins, themes, PHP versions, or other components that deserve attention.
Should You Update to WordPress 7.0.3 Right Away?
Yes, but the update should still be handled properly.
WordPress recommends updating immediately because 7.0.3 is a security release.
For a basic website with a simple configuration, the update may be straightforward.
Business websites can be more complicated.
A WordPress website may depend on:
- A custom or third-party theme
- Page builders
- Contact forms
- Ecommerce functionality
- Payment processing
- Membership systems
- Scheduling or booking integrations
- Analytics and tracking scripts
- SEO plugins
- Security software
- Caching and performance systems
- Custom PHP, CSS, or JavaScript
- Dozens of additional WordPress plugins
That is why we recommend treating WordPress updates as part of an ongoing website maintenance process rather than blindly clicking “Update.”
Back Up Your Website Before Updating
Before making significant WordPress Core, theme, or plugin changes, your website should have a current backup.
Ideally, that means having both your website files and database backed up.
A reliable maintenance process should also give you a way to restore the previous working version of the website if an update causes an unexpected compatibility issue.
After updating, important website functionality should be checked.
That can include testing:
- Homepage and major landing pages
- Navigation
- Contact forms
- Mobile layouts
- Ecommerce functionality
- Checkout or payment systems
- Login areas
- Booking systems
- Important integrations
The goal isn’t simply to make the WordPress dashboard say “7.0.3.”
The goal is to make sure the website remains secure and functional after the update.
What WordPress 7.0.3 Means for Small Business Websites
For most small business owners, WordPress security isn’t something they want to think about every week.
And it shouldn’t have to be.
But somebody needs to be paying attention.
WordPress Core changes. Plugins change. Themes change. PHP evolves. Security vulnerabilities are discovered. Compatibility requirements shift.
A business website is software, not a finished brochure that can be uploaded once and forgotten.
WordPress 7.0.3 is a good example of why ongoing website maintenance matters.
The original WordPress 7.0 release introduced the larger platform changes. This update doesn’t need flashy new features to be important.
Sometimes the most important WordPress update is the one quietly fixing vulnerabilities behind the scenes.
Managed WordPress Maintenance Is More Than Clicking Update
A properly managed WordPress website should have an ongoing process for:
WordPress Core updates
Keeping WordPress itself current as maintenance and security releases become available.
Plugin updates
Maintaining the software that adds functionality to the website.
Theme updates
Keeping the site’s theme and supporting components current.
Security monitoring
Watching for issues that could affect the website or its visitors.
Backups
Maintaining recoverable copies of the website and database.
Compatibility checks
Making sure updates don’t unexpectedly interfere with important website functionality.
Content updates
Keeping information, photos, services, team members, calls-to-action, and other website content current.
A website should support your business, not create another maintenance checklist for you to manage.
Our Recommendation on WordPress 7.0.3
If your website is running an affected version of WordPress, do not unnecessarily delay this security update.
WordPress 7.0.3 addresses 12 disclosed security vulnerabilities, and WordPress itself recommends updating immediately.
If your website is professionally managed, confirm that your provider is handling the update.
If you manage WordPress yourself, make sure you have a reliable backup before updating and test your website afterward.
And if you aren’t sure who’s responsible for maintaining your WordPress website, that’s probably something worth figuring out before the next security update arrives.
Need Help Managing Your WordPress Website?
Your website should help you run your business, not turn you into a part-time website administrator.
616 Marketing Group has been building and maintaining WordPress websites since WordPress 3.0.2 in 2010.
Our managed web hosting and WordPress support services are designed to take the technical workload off your plate, including routine WordPress updates, plugin updates, website maintenance, security, content updates, local support, and more.
Whether you need help maintaining an existing WordPress website or you’re ready for a complete website redesign, our team can help keep your digital presence secure, current, and working for your business.
Get your time back and leave the WordPress maintenance to the experts.
Official sources: WordPress 7.0.3 Release Announcement and WordPress 7.0.3 Documentation. WordPress’s documentation confirms the August 6 release date, 12 addressed vulnerabilities, affected older branches, and immediate-update recommendation.