WordPress has shipped an emergency security update to fix a pre-authentication cross-site scripting vulnerability in its login page that can be chained into remote PHP code execution, putting virtually every unpatched WordPress site at risk.[1][3][4] The flaw allows attacker-controlled JavaScript to execute in a site’s origin before any login, raising the stakes for administrators and hosting providers that have not yet deployed the latest security release.[1][2][6]
Tracked as CVE-2026-64638 and dubbed XSS2Shell, the bug carries a CVSS v3 base score of 8.9 (high) and requires no attacker authentication to trigger the initial XSS on the wp-login.php screen.[2][3][6] The issue was discovered by researchers at pwn.ai, who detailed a multi-stage exploit chain that turns the login-page XSS into reliable server-side PHP code execution when a logged-in administrator is lured to an attacker-controlled website.[1][4][11] While the remote code execution stage depends on social engineering and specific conditions, the underlying pre-auth XSS alone is sufficient for session hijacking, credential theft and other high-impact browser-side attacks.[2][6][11]
According to vulnerability write-ups, the flaw stems from how WordPress reflects user-supplied input in the login error message after a failed login attempt, combined with subtle parsing discrepancies between PHP’s strip_tags() and WordPress’s wp_kses_post() sanitization, DOM clobbering techniques and a REST API JSONP callback.[4][6][9] By crafting a specially formatted username and delivering it via a malicious site or link, an attacker can cause the login error page to render executable JavaScript in the context of the target WordPress origin, without any clicks or authentication required for the XSS stage.[1][2][6] In the full XSS2Shell chain, that JavaScript then abuses an already-authenticated administrator’s browser to perform privileged actions against their own site, culminating in uploading or modifying server-side PHP code.[4][6][11]
The National Vulnerability Database and WordPress security advisories list all supported WordPress branches prior to version 7.0.3 as affected, with fixes backported through the 4.7 series.[3][5][13] Security analyses note that this effectively means every actively maintained WordPress site is vulnerable until updated, and pwn.ai estimates that more than 500 million websites were exposed at disclosure, given WordPress’s dominant share of the web.[4][5] Hosting providers and managed WordPress platforms have begun notifying customers that the 7.0.3 security release addresses CVE-2026-64638, urging immediate patching or enabling of automatic core updates.[1][8]
At the time of writing, security trackers report that multiple proof-of-concept exploits for XSS2Shell are already available in public code repositories, lowering the barrier for opportunistic attackers.[2][4] However, vendors monitoring the situation say they have not yet confirmed widespread exploitation in the wild as of August 7, 2026, even as scanning and reconnaissance traffic targeting the login endpoint is expected to increase.[2][6] Independent researchers and security news outlets nonetheless warn that the combination of pre-auth reach, simple triggering conditions and the prospect of eventual remote code execution make this a prime candidate for inclusion in automated mass-exploitation toolchains.[1][11]
Administrators are strongly advised to upgrade WordPress to version 7.0.3 or to the latest security release offered on their supported branch, as the fix for CVE-2026-64638 has been backported to all maintained versions from 4.7 onward.[3][5][6] Sites that rely on automatic background updates should confirm that the security release has been applied, while organizations that pin versions or manage large fleets should prioritize urgent rollout and coordinate with their hosting providers.[1][8] Until upgrades are complete, defenders can reduce exposure by restricting access to wp-login.php, tightening controls around administrator authentication, and monitoring for login error traffic that contains suspicious HTML-like payloads. Given the trivial pre-authentication trigger, the availability of working exploit code and WordPress’s massive install base, defenders should assume that XSS2Shell will soon be weaponized at scale and act quickly to close this window of opportunity.[2][4][11]
References
- New WordPress Pre-Auth XSS Could Lead to PHP Code Execution
- CVE-2026-64638 – Exploits & Severity – Feedly
- CVE-2026-64638 Detail – NVD
- XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)
- XSS2Shell: WordPress Pre-Auth XSS to RCE Chain (CVE-2026 …
- XSS2Shell (CVE-2026-64638): WordPress Login Page Pre-Auth XSS …
- WordPress XSS Vulnerability (CVE-2026-64638) – Reclaim the Blog
- WordPress 7.0.3: security-релиз, CVE-2026-64638 и XSS на экране входа
- WordPress XSS2Shell Flaw Lets Unauthenticated Attackers Gain …
- WordPress 7.0.3 release
