Published on August 8, 2026
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution
Severity
High
Detail
WordPress has disclosed a high-severity pre-authentication reflected cross-site scripting (XSS) vulnerability affecting the WordPress login screen. Tracked as CVE-2026-64638, the vulnerability requires no authentication or attacker privileges and can allow malicious JavaScript to execute in a victim’s browser through a specially crafted username.
Researchers at pwn.ai demonstrated that the vulnerability can be chained with a logged-in Administrator session to achieve PHP code execution on the WordPress server. The attack requires the administrator to interact with an attacker-controlled page. The attack abuses inconsistencies in WordPress username sanitization and parsing to inject attacker-controlled HTML into the failed-login page. The injected content can manipulate WordPress JavaScript and abuse REST JSONP functionality to execute JavaScript within the site’s origin.
Researchers demonstrated an escalation path that abuses WordPress Application Password functionality to obtain authenticated REST API access, upload an attacker-controlled plugin ZIP, and execute PHP code on the server. Successful exploitation could expose WordPress database credentials, allow creation of persistent administrator accounts, modify website content, access files and secrets available to the PHP process, and potentially execute operating-system commands with the PHP worker’s privileges.
| CVE ID | Summary | CVSS Score |
| CVE-2026-64638 | Pre-authentication reflected XSS vulnerability in the WordPress login screen allowing unauthenticated attackers to execute arbitrary JavaScript. Under specific conditions, the vulnerability can be chained with a logged-in Administrator session to achieve PHP code execution. | 8.9 (High) |
Affected Products
The vulnerability affects WordPress installations across supported versions, including:
- WordPress versions prior to 7.0.3.
- Supported WordPress branches back to version 4.7.
- Versions older than 4.7 remain affected but are outside the current security backport range.
Recommendation
Organizations should implement the following measures to reduce the risk of exploitation:
- Upgrade WordPress immediately to version 7.0.3 or the latest security release available for the applicable branch.
- Enable automatic background security updates where supported.
- Review WordPress installations for unauthorized administrator accounts, unexpected content changes, suspicious plugins, and newly created PHP files.
- Review web-server and WordPress logs for suspicious login-page, REST API, Application Password, or plugin-upload activity.
- Do not rely solely on existing WordPress hardening measures or Content Security Policy as a mitigation.
Source
https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html