Following the emergency release of WordPress 7.0.2 for wp2shell, now comes WordPress 7.0.3 as a security maintenance release with 12 security patches heavily affecting the login screen.
Remember that you can listen this program from:
Program transcript
Hello, I’m Alicia Ireland, and you’re listening to WPpodcast, bringing the weekly news from the WordPress Community.
In this episode, you’ll find the information from August 3 to 9, 2026.
Matt Mullenweg has published a brief but far-reaching reflection on how to design WordPress for a future with more AI agents operating on the site, laying out a series of “defensive” data design principles: that sending something to trash should be easy but truly deleting it should be hard, that publishing a draft to the world should cost more than creating it, that changes should be reversible and visible whenever possible, and that error messages should explain the why, not just the what, with a copy button so you can paste them directly into a search engine or an AI. He also urges assuming that everything coming from outside — whether network, format, or structure — is not just unreliable but potentially hostile, and betting on plain, direct language instead of technical jargon.
The post has generated considerable debate in the comments, with members of the Gutenberg team confirming they’re already updating style guides and documents for AI agents with these principles, and several concrete improvements already merged into content save error messages. Among the proposals that have resonated most is “human 2FA”: certain tasks get marked as sensitive and can only be completed if a person explicitly approves them, with an intermediary agent explaining in plain language what’s about to happen before asking for the go-ahead. Another comment points out that this “publishing is hard” principle aligns with the old proposal for a scheduled review state, where an AI agent editing already-published content creates by default a future draft pending review, instead of publishing the change directly.
Just weeks after the emergency release of 7.0.2 for the wp2shell exploit chain, WordPress publishes another security update, 7.0.3, with twelve vulnerabilities fixed in one go. The standout one, and the only one with a public CVE, CVE-2026-64638, is a reflected XSS on the login screen that requires no authentication and could, under certain circumstances, lead to PHP code execution. The rest of the flaws, though without their own CVE yet, are not minor: several stored XSS issues needing at least Contributor role (in emoji settings, in the post content block, in Quick Edit on sites with many users, and in the post date block), a privilege escalation in multisite networks with open registration that allowed creating a new site, an SSRF in URL validation, a bypass of the safe CSS filter for Author-or-above users — reported curiously by Anthropic — and several information disclosure issues: comments on password-protected posts exposed via the Recent Comments block, notes leaked in comment feeds, and post slug enumeration.
Unlike 7.0.2, which was an off-schedule emergency release due to the severity of the remote code execution chain, this 7.0.3 has more of a routine security maintenance profile, though the advice is the same as always: update as soon as possible. What does stand out is the scope of the backport: the technical sheet on HelpHub confirms 24 different versions have been released in one go, from 7.0.3 itself down to 4.7.34, each with the subset of flaws that applied to it (6.9 receives 11 of the 12, and the rest of the active branches down to 4.7 receive between 7 and 8, depending on how many were vulnerable). At the code level, the patch concentrates in very specific files: wp-login and wp-signup for the login XSS and email confirmation bypass, kses for the CSS filter reported by Anthropic, canonical for slug enumeration, http for the SSRF, and user management and Quick Edit files for the privilege escalation and corresponding XSS.
WordPress 7.1 RC2, published the same day, already incorporates all these fixes, so anyone testing 7.1 doesn’t need to do anything extra. Once again, check version and update as soon as possible on any site.
WordPress 7.1 has officially entered release candidate phase, with RC2 already published, which activates a series of internal Core team rules until final release. The most relevant is that, until a specific 7.1 branch is created — delayed a few days due to ongoing GitHub Actions work — any change to main development needs the approval of two different committers instead of one, to minimize the risk of introducing regressions at such a delicate point in the cycle.
The first release candidate also marks the string freeze: from now on new text is not permitted except in very specific marked exceptions, which gives the Polyglots team the green light to start translating the version into different languages as soon as that branch is ready. As for what can still be touched before release, only two types of tickets are accepted: regressions introduced during this development cycle, and expansions of the test suite, which can be added at any time without restrictions.
The Accessibility team has taken stock of a year of work reorganizing all its documentation, a project that started after discovering at WordCamp Europe Torino that accessibility information was scattered, duplicated, and incomplete. The result is the new WP Accessibility Knowledge Base, now the single source of reference: it covers everything from an introduction to WCAG and the accessibility-ready theme program, to content, image, form, and frontend code standards, including guides for manual testing and screen reader testing. The team’s handbook on Make WordPress, meanwhile, has been reduced to strictly team-related matters and how to contribute, leaving all the technical part in the new knowledge base.
And finally, this podcast is distributed under a Creative Commons license as a derivative version of the podcast in Spanish; you can find all the links for more information, and the podcast in other languages, at WPpodcast .org.
Thanks for listening, and until the next episode!
Leave a Reply