WordPress 7.0.2 – 9 Security Vulnerabilities Fixed in 7.0.3

WordPress 7.0.3 is not an update you want to leave for later. It patches nine security vulnerabilities in version 7.0.2 (and earlier releases in that series) — including two that can be exploited without any login at all. That means any automated scanner crawling the web for vulnerable installs can find them before you get around to updating manually.

What exactly does WordPress 7.0.3 fix?

Here's the full list of vulnerabilities fixed in this release, as described in the WPScan database:

• Subscriber+ Email Change Confirmation Bypass — a logged-in user with the lowest privilege level (Subscriber) can bypass the confirmation step when changing the email address tied to their account.
• Unauthenticated Blind SSRF — an attacker without any login can force the WordPress server to send a request to an address of their choosing (e.g. an internal network address), without seeing the response directly ("blind"). No account is required, so it's reachable by any bot scanning the web.
• Unauthenticated Internal Note Disclosure via Comment Feeds — an unauthenticated visitor can read private internal notes through comment RSS feeds.
• Author+ CSS Injection — a user with the Author role (or higher) can inject malicious CSS.
• Unauthenticated Non-Public Post Type Slug Disclosure (CVE-2023-5692) — an unauthenticated attacker can discover the slugs of posts belonging to non-public post types.
• Contributor+ Stored XSS in Quick Edits — a user with the Contributor role can store a malicious script through the Quick Edit feature, which then runs in the browser of anyone viewing it in the admin panel (e.g. an administrator).
• Subscriber+ Arbitrary Site Creation on Multisite — on a Multisite installation, a logged-in Subscriber can create an arbitrary new site without the permissions normally required to do so.
• Contributor+ Stored XSS via Emoji Settings Element — a Contributor can permanently store a malicious script through the emoji settings element.
• Reflected XSS — a malicious script is embedded in a link or request and executes immediately in the browser of whoever opens it.

All nine vulnerabilities are fixed in WordPress 7.0.3. You'll find the full, up-to-date list with source links in our WordPress vulnerability (CVE) database.

Why the two "unauthenticated" vulnerabilities matter most

Most of the vulnerabilities above require an account on the site — Subscriber, Contributor, or Author. That's a real risk mainly for sites with open registration, multiple authors, or a Multisite setup. But two of them — Blind SSRF and Non-Public Post Type Slug Disclosure — require no login whatsoever. That means they're reachable by anyone who lands on your site, including automated bots mass-scanning the web for vulnerable WordPress installs. This is exactly the type of flaw that tends to end up in ready-made exploit scripts within days of the patch being published.

How to check if your site is affected

If you're not sure which WordPress version you're running, check your admin dashboard (Dashboard → Updates) or your homepage's source code. Versions 7.0 through 7.0.2 are affected by all nine vulnerabilities listed above — version 7.0.3 and later already have them fixed. You can also look up any WordPress core version in our public CVE database, no account required.

If you monitor your site with MonitorWWW.com, your WordPress core version is checked automatically against the same vulnerability database — you get an alert the moment your installed version has a known, unpatched security flaw, with no manual update-tracking required. We covered how this works in more detail in Critical WordPress Vulnerabilities (CVE) — New in Monitoring.

How to update safely

• Take a full backup of your files and database before updating — WordPress core updates rarely break a site, but this is the one moment where a backup is genuinely cheap insurance.
• If you have a staging environment, update there first and confirm your plugins and theme still work correctly.
• Update WordPress to version 7.0.3 (Dashboard → Updates → Update Now, or automatically if you have background updates enabled).
• After updating, check key site functions — login, your contact form, and for stores: checkout and payments.

Summary

Nine vulnerabilities fixed in WordPress 7.0.3 is more than usual — and two of them require no login at all, so this update is realistically urgent, not cosmetic. If you manage more than one WordPress site, manually tracking patches like this quickly becomes unworkable — which is why automatically checking your version against the CVE database beats trying to remember every update individually.