WordPress has released a security update fixing a high-severity cross-site scripting vulnerability in its login page that affects every version of the content management system.
Security researchers at pwn.ai found that the flaw could potentially be chained into PHP code execution when a logged-in administrator interacts with an attacker-controlled page.
Tracked as CVE-2026-64638 with a CVSS score of 8.9, the vulnerability is a pre-authentication reflected XSS flaw that requires no attacker privileges or authentication. According to pwn.ai, an attacker can place a specially crafted username into a failed login request, causing malicious JavaScript to execute in the browser when the resulting error page is viewed.
The initial XSS does not require the victim to be logged in. However, the researchers demonstrated that the attack can be escalated when an administrator who is already logged into WordPress visits an attacker-controlled page and performs an ordinary click.
The researchers said the attack works against default WordPress installations and does not require unusual hosting configurations. They identified multiple potential paths from the XSS to PHP code execution, including methods involving plugin installation or uploading a malicious ZIP file.
WordPress takes a more cautious position on the full attack chain, noting that reaching remote code execution requires additional conditions outside the attacker’s control, as well as successful social engineering and explicit interaction from the victim.
The vulnerability was patched on August 6 with the release of WordPress 7.0.3, with the fix also backported to supported older branches as far back as version 4.7. WordPress recommends that administrators update their websites immediately. Sites with automatic background security updates enabled should receive the fix automatically.
Versions older than 4.7 remain affected but are outside WordPress’s current security backport range.
The researchers named their attack chain XSS2Shell and said an autonomous system discovered and reproduced the vulnerability after being provided with security researcher Paulos Yibelo’s 2022 research on Same Origin Method Execution. According to pwn.ai, the work took nearly four days using open-source AI models and a multi-agent workflow. The attack chain was reproduced on July 26 and reported to WordPress the following day.
The vulnerability originates from how WordPress processes usernames submitted during failed logins. According to the researchers, the username passes through multiple sanitization and HTML-processing functions that interpret certain specially crafted input differently. This can ultimately result in attacker-controlled HTML elements being placed into the failed-login page.
Those elements can then interact with WordPress’s own JavaScript code loaded on the login page. The researchers found that missing elements and an undefined variable could be manipulated to redirect a same-origin REST request toward an attacker-controlled destination.
The attack can then take advantage of WordPress’s REST JSONP functionality to execute JavaScript in the site’s origin. The researchers also found a technique involving the _envelope=1 parameter that can allow certain unauthorized REST responses to be processed as JavaScript.
One demonstrated escalation path involves WordPress Application Passwords. An attacker can use the XSS to trigger the Application Password approval process inside a logged-in administrator’s session. WordPress can then generate an API credential and redirect it to an attacker-controlled HTTPS URL.
Using that credential, the researchers demonstrated authenticated REST access that could be used to publish a WordPress page containing same-origin JavaScript. When the administrator’s session later opened the page, the script could obtain a plugin-upload nonce and upload a malicious ZIP containing PHP code. The researchers noted that the plugin did not need to be activated for the demonstrated PHP execution path.
The researchers said their production testing stopped at the initial XSS. They reproduced the login-page vulnerability against fresh WordPress 7.0.2 installations using Chrome without existing WordPress cookies or credentials. The complete PHP execution chain was demonstrated separately on a clean local WordPress 7.0.2 installation.
A successful PHP execution could give an attacker extensive control over a compromised WordPress site, potentially exposing database credentials stored in wp-config.php, allowing persistent administrator accounts or content changes, accessing files and secrets available to the PHP process, and executing operating-system commands with the privileges of the web server.
WordPress credited pwn.ai for responsibly reporting the vulnerability. As of August 7, the WordPress security advisory did not report evidence that CVE-2026-64638 had been exploited in the wild.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
For WordPress administrators, the most important step is straightforward: update to the latest available security release as soon as possible rather than relying on additional hardening measures as a replacement for the patch.
WordPress Fixes Critical Login XSS Flaw That Could Lead to PHP Code Execution
