Full Report
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,
Analysis Summary
Based on the provided article, here is the summary of the vulnerability affecting WordPress.
# Vulnerability: WordPress Pre-Authentication XSS to RCE (XSS2Shell)
## CVE Details
- **CVE ID:** CVE-2026-64638
- **CVSS Score:** 8.9 (High)
- **CWE:** Not explicitly stated (Relates to CWE-79: Improper Neutralization of Input During Web Page Generation)
## Affected Systems
- **Products:** WordPress Content Management System (CMS)
- **Versions:** All versions prior to 7.0.3 are affected. Fixes were backported to version 4.7. Versions older than 4.7 remain vulnerable.
- **Configurations:** The base XSS affects the login screen. The full RCE chain requires a victim with Administrator privileges to be logged in and a specific sequence of WordPress features (REST JSONP, Application Passwords) to be enabled.
## Vulnerability Description
The flaw originates from inconsistent sanitization of the username field on the login page. When a login fails, the username is processed by `sanitize_user()` and `wp_strip_all_tags()`. Because of the way the underlying PHP `strip_tags()` function handles whitespace, certain tag-like strings (e.g., `< svg`) survive this process.
Later, when the value is passed through `wp_kses_post()`, it is interpreted as live HTML. This allows for DOM clobbering of the `ajaxurl` variable. By manipulating this variable, an attacker can redirect the site's own JavaScript (`user-profile.js`) to make a same-origin REST request. Using WordPress’s JSONP support, this request is converted into arbitrary JavaScript execution within the site's origin.
## Exploitation
- **Status:** PoC available (Demonstrated by pwn.ai researchers)
- **Complexity:** Medium to High (XSS is low complexity; the RCE chain requires multiple conditions and administrative interaction)
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full server access possible via RCE)
- **Integrity:** High (Ability to modify files, plugins, and database)
- **Availability:** High (Potential for complete site takeover or deletion)
## Remediation
### Patches
- **WordPress 7.0.3:** The primary security release.
- **Backports:** Fixes are available for all versions from the **4.7 branch** through **7.0.2**. Sites with automatic background updates enabled should update automatically.
### Workarounds
- No specific software workarounds provided; immediate patching is the recommended course of action.
- Ensure that versions older than 4.7 (which are no longer supported) are migrated to a supported, patched version.
## Detection
- **Indicators of Compromise:** Unusual "Application Passwords" generated for Administrator accounts; unauthorized ZIP files uploaded to the plugins directory; suspicious JavaScript payloads in failed login logs.
- **Detection methods and tools:** Security plugins that monitor file integrity for the `wp-content/plugins` directory and audit logs that track Application Password creation.
## References
- **Vendor Advisory:** hxxps://wordpress[.]org/news/2026/08/wordpress-7-0-3-release/
- **Technical Analysis:** hxxps://pwn[.]ai/blog/xss2shell
- **Source Article:** hxxps://thehackernews[.]com/2026/08/new-wordpress-pre-auth-xss-could-lead.html