WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) vulnerability in the login screen that affects every version of the content management system. Under additional conditions, the flaw could be combined to execute PHP code on the server.
See also: CVE-2026-63030: critical WordPress vulnerability in CISA KEV as actively exploited
The vulnerability, which has been registered as CVE-2026-64638 (CVSS score: 8.9), is of high severity and does not require privileges from the attacker. According to pwn.ai, which discovered the flaw and shared technical details with The Hacker News, XSS on the login page can be executed without an account or additional interaction from the victim once the crafted request is delivered.
The path to code execution is more difficult. The proven chain requires a victim already logged in as an Administrator of a single site, a simple click on a page controlled by the attacker, and several WordPress features and deployment conditions to align.
The issue was fixed on August 6 in WordPress 7.0.3, with fixes extended to the 4.7 branch. WordPress recommends updating immediately, and sites that support automatic background updates will receive the security release automatically. Versions older than 4.7 remain vulnerable but are outside the project's current scope of extensions. WordPress powers 41.2% of all websites, according to W3Techs.
pwn.ai, which calls the attack chain XSS2Shell, said its autonomous system discovered and replicated the vulnerability chain after being given Paulos Yibelo 2022 research on Same-Origin Method Execution (SOME) as a starting point. The company said the work took nearly four days using open-source models and a multi-agent workflow. The chain was replicated on July 26 and reported on WordPress the next day.
The vulnerability starts with the way WordPress handles the username from a failed login. According to the researchers, the value is passed through the sanitize_user() and wp_strip_all_tags(), which are based on strip_tags() . A tag-like string containing spaces after the opening < can survive this parser as text. Later, WordPress passes the value through wp_kses_post(), whose separate parser interprets the same input as valid HTML.
See also: wp2shell exploit: public PoCs for critical WordPress RCE — active exploit
The result is DOM elements that are controlled by the attacker on the failed login page. These elements then interact with WordPress's user-profile.js, a profile management script that is also loaded on the login page because the page handles password resets.
Some profile elements that the script expects are missing there: two missing inputs both resolve to undefined, allowing an equality check to pass, while the otherwise undefined ajaxurl variable can be corrupted with an injected DOM element. This directs the WordPress JavaScript to a same-origin REST request chosen by the attacker.
Researchers use WordPress's REST JSONP support to convert this request into JavaScript that runs on the site's origin. For deployments where anonymous REST requests return HTTP 401, the _envelope=1 can wrap the denial in an external HTTP 200 response, allowing jQuery to continue processing the response as a script.
The researchers also found in their tests that a nonce-based Content Security Policy using strict-dynamic did not block the proven path.
The path from XSS to PHP execution is based on Yibelo's previous SOME technique, which uses an allowed JSONP property chain to call a method in another browser window.
In the pwn.ai demo, the WordPress-originated XSS calls the native Application Password authorization check within a logged-in Admin session. WordPress then generates an API credential and redirects it to an HTTPS success address chosen by the attacker.
See also: Gravity SMTP: How to protect yourself from CVE-2026-4020 – Total WordPress Security
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Application Passwords are revocable credentials intended for API access, so the chain doesn’t need to steal the administrator’s master password. The researchers used the credential for authenticated REST access to publish a WordPress page containing same-origin JavaScript. When the administrator’s persisted session opened this page, its script obtained the nonce for the WordPress plugin upload and launched an attack.
