Critical WordPress Login Vulnerability Allows Pre-Auth XSS, Chaining to Code Execution
A high-severity pre-authentication reflected XSS vulnerability in WordPress's login screen, CVE-2026-64638, has been patched, with researchers demonstrating its potential to lead to PHP code execution.
WordPress has released an urgent security update to address a critical pre-authentication reflected cross-site scripting (XSS) vulnerability affecting all versions of its widely-used content management system. The flaw, designated CVE-2026-64638 and carrying a CVSS score of 8.9, resides within the login screen and, under specific conditions, can be chained by attackers to achieve PHP code execution on the server.
The vulnerability was discovered by researchers at pwn.ai, who detailed how the flaw requires no attacker privileges and can be exploited without authentication. When a crafted username is submitted, the resulting error message displayed on the failed-login page contains JavaScript that executes in the visitor's browser. This initial XSS payload, while potent, requires further steps to escalate to full code execution.
Achieving PHP code execution necessitates a victim who is already logged in as an administrator and then interacts with an attacker-controlled page. In a demonstration by pwn.ai, this interaction was as simple as a single click. The researchers confirmed that the attack is effective against default WordPress installations and does not rely on specialized hosting configurations. They have identified multiple pathways from the initial XSS to code execution, including methods to install a plugin or upload arbitrary ZIP files.
While WordPress's official advisory acknowledges the exploitability, it emphasizes that the escalation to Remote Code Execution (RCE) involves factors outside the attacker's direct control, requiring successful social engineering and explicit user interaction. Nevertheless, the potential impact is significant, ranging from data exfiltration to complete system compromise.
The security patch was deployed on August 6th in WordPress version 7.0.3, with fixes backported to the 4.7 branch. WordPress strongly advises all users to update their installations immediately. Sites configured for automatic background updates should receive the security release automatically. However, versions older than 4.7, while still affected, are no longer within the project's active backporting range.
The researchers have dubbed the attack chain "XSS2Shell." Their work built upon previous research, specifically Paulos Yibelo's 2022 "Same Origin Method Execution" (SOME) technique. The process involved using open-source AI models and a multi-agent workflow, taking approximately four days to discover and reproduce the vulnerability chain. The flaw was reported to WordPress the day after its reproduction.
The vulnerability exploits how WordPress handles usernames during failed login attempts. Input sanitization functions like sanitize_user() and wp_strip_all_tags() fail to properly neutralize certain tag-like strings containing whitespace, allowing them to survive as text. Subsequently, wp_kses_post(), another WordPress function, misinterprets this input as permitted HTML, leading to the injection of attacker-controlled DOM elements on the failed-login page. These elements then interact with user-profile.js, a script also present on the login page due to password reset functionality.
This interaction allows an attacker to manipulate WordPress's own JavaScript, steering it towards an attacker-chosen REST API request. By leveraging WordPress's REST JSONP support, this request can be transformed into executable JavaScript within the site's origin. For deployments where anonymous REST requests return HTTP 401 errors, the _envelope=1 parameter can be used to wrap the denial in an HTTP 200 response, enabling jQuery to process the response as script. The researchers noted that even Content Security Policies with strict-dynamic did not prevent the demonstrated attack path. The full chain to PHP execution, demonstrated separately, involves using the XSS to invoke the native Application Password approval control within a logged-in administrator's session, thereby creating a new API credential that can be used to upload malicious plugins or directly execute PHP code.