WordPress 7.0.3, released 6 August 2026, patches CVE-2026-64638 (XSS2Shell) -- a high-severity login-screen flaw that can be chained to full server takeover. Here is what you need to check and do.