WordPress 7.0.3 has been released, addressing 12 security vulnerabilities across the platform, including a flaw that could allow PHP code execution, multiple cross-site scripting (XSS) vulnerabilities, privilege escalation, server-side request forgery (SSRF), information disclosure, and email confirmation bypass issues. The security fixes include vulnerabilities reported by researchers and organizations such as pwn.ai, Anthropic, and Aikido Security.
Security vulnerabilities addressed in WordPress 7.0.3
The release fixes a pre-auth reflected cross-site scripting (XSS) vulnerability on the WordPress login screen with the potential to lead to PHP code execution, reported by the team at pwn.ai. It also addresses a privilege escalation issue affecting Multisite networks with user registration enabled, which could allow a user to create a new site, reported by Aikido Security. Another vulnerability fixed in the update is an Author+ CSS injection issue caused by a bypass of the safe CSS attribute filter, reported by Anthropic.
The update also resolves four Contributor+ stored cross-site scripting vulnerabilities. These include an issue in posts through the emoji settings element reported by Asaf Mozes, a vulnerability in the Post Content block reported by n05ec, a Quick Edit issue on sites with a large number of users reported by Naveen S and Ajmal Moochingal, and a Post Date block vulnerability reported by Alex Concha of the WordPress Security Team.
Besides these, it also fixes an information disclosure issue in the Latest Comments block that could expose comments on password-protected posts, reported by Ehtisham Siddiqui of the WordPress Security Team. Additional fixes address post slug enumeration, disclosure of notes in comment feeds, a bypass of the email address confirmation flow, and a server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges.
The security fixes are being backported, where necessary, to all branches eligible to receive security updates, currently through WordPress 4.7. WordPress 7.1 RC2 has also been released with all applicable fixes included.
This follows the previous WordPress 7.0.2 security release, which addressed a high-severity SQL injection vulnerability and a pre-authentication remote code execution (RCE) vulnerability known as wp2shell. The RCE issue involved a REST API batch route and handler confusion vulnerability, while the SQL injection issue affected WP_Query.
The wp2shell exploit chain was discovered by Adam Kues of Searchlight Cyber using OpenAI’s GPT-5.6 Sol Ultra model. According to Kues, the model identified the pre-authentication SQL injection vulnerability and helped develop the path to remote code execution in just over 10 hours, with the total usage cost estimated at around $25.
AI-assisted security research and rising vulnerability reports
Patchstack Security Researcher Chazz Wolcott highlighted the role of AI-assisted security research in recent WordPress vulnerability discoveries, including the wp2shell exploit chain addressed in WordPress 7.0.2 and vulnerabilities reported by pwn.ai and Anthropic in WordPress 7.0.3.
Discussing the change in vulnerability research, Wolcott wrote, “A few months ago, AI-assisted research meant a human researcher with a model as a very fast assistant. Now the model finds the vulnerability, can take their finding all the way to exploitation, and all the researcher needs to do is report it.”
Wolcott also referenced a chart by John Blackbourn showing WordPress security reports submitted through HackerOne. The chart shows that reports, which had typically remained in the dozens per month over the previous years, reached 450 reports in July.
Following the release, David Risley questioned whether the recent frequency of security updates could be connected to changes in AI-assisted security research, writing, “Yet another security release for WordPress, I see. Seems more frequent. Wonder if this is a result of AI vibe coding… or perhaps AI finding holes that weren’t seen previously.”
Tim Bouchard also shared his view on the release frequency, suggesting that the recent micro updates were a result of WordPress 7.x being “rushed,” writing, “Wordpress 7.x was rushed and these micro updates that need instant installation is the result.”