Critical WordPress Login XSS Flaw (CVE-2026-64638) Enables RCE — Patch Now

WordPress has patched a high-severity, pre-authentication reflected cross-site scripting vulnerability in its login screen that affects every version of the content management system. Tracked as CVE-2026-64638 with a CVSS score of 8.9, the flaw was disclosed by researchers at pwn.ai and requires no attacker privileges to exploit. Once a crafted username reaches the failed-login error page, the resulting JavaScript executes in the visitor's browser with no further interaction on that page, making it dangerous for any site handling administrative logins. The fix was released on August 6 in WordPress 7.0.3, with backports shipped through the 4.7 branch; sites with automatic background updates enabled should already be protected.

What elevates this bug beyond a typical reflected XSS is its escalation path. pwn.ai demonstrated that the login-page injection can be chained into full PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page — in their proof-of-concept, a single ordinary click was enough. The researchers, who branded the chain "XSS2Shell," showed multiple routes from XSS to RCE, including variants that silently install a plugin or upload an arbitrary ZIP archive. WordPress's own advisory takes a more conservative view, noting that escalation hinges on conditions outside the attacker's control and requires successful social engineering plus explicit victim interaction. The flaw originates in how WordPress handles a malformed username: a tag-like string containing whitespace after `<` survives sanitize_user() and wp_strip_all_tags() as text, but wp_kses_post()'s separate parser reinterprets the same input as permitted HTML, producing attacker-controlled live DOM elements on the failed-login page.

The pwn.ai team reported that their autonomous, multi-agent system discovered and reproduced the full chain in roughly four days using open-source models, building on Paulos Yibelo's 2022 Same Origin Method Execution (SOME) research. The vulnerability was reproduced on July 26 and disclosed to WordPress the following day. Administrators running versions older than 4.7 remain affected but fall outside the project's current backport range, leaving legacy installations exposed. Given that default WordPress deployments are vulnerable and that the login page is internet-facing on virtually every installation, site owners should verify they are running 7.0.3 (or a patched 4.7+ release) immediately and audit administrator accounts for signs of compromise.

Defenders should treat any unpatched WordPress instance as a high-priority remediation target. Confirm your site's exposure by checking the version reported in your admin dashboard and your server response headers — a quick pass through the SSL/TLS checker and port scanner can help surface exposed admin surfaces and certificate misconfigurations that compound login-page risk. Review administrator accounts for unexpected plugin installations or recent password resets, rotate any credentials that may have been exposed, and run a full password checker audit on administrative accounts to ensure no credentials appear in known breach corpora. Until the patch is confirmed in production, restricting wp-admin access by IP and enforcing MFA on all administrator accounts will materially reduce the probability that the XSS2Shell chain succeeds against your environment.