CVE-2026-64638

WordPress Login Page Exposed to Critical XSS2Shell Flaw CVE-2026-64638: Over 11,000 Sites Attacked Across 67 Countries

WordPress core login page vulnerability CVE-2026-64638 enables unauthenticated attackers to trigger reflected XSS that can escalate to full server compromise. The flaw stems from mismatched HTML sanitization between two filtering layers on the wp-login.php page, allowing malicious payloads to execute in the site origin. Imperva observed automated campaigns hitting more than 11,000 sites with hundreds of thousands of requests, predominantly affecting U.S. targets in gaming, education, and finance sectors. Successful exploitation chains the XSS into WordPress REST API and application password creation when an administrator is logged in, ultimately allowing malicious plugin uploads. Official patches are available in WordPress 7.0.3 and backported releases down to 4.7; administrators are urged to verify versions, audit user accounts, and inspect plugin directories immediately.

WordPress Patches High-Severity XSS2Shell Flaw Enabling Remote Code Execution (CVE-2026-64638)

WordPress has released a fix for a high-severity vulnerability in its core that can turn a malicious login attempt into remote PHP code execution on the server. The flaw, tracked as CVE-2026-64638 and rated 8.9 on CVSS, is named XSS2Shell and begins as a reflected cross-site scripting issue on the authentication screen. An unauthenticated attacker can submit a specially crafted username that bypasses sanitization mechanisms due to differences in how PHP and WordPress interpret certain characters, allowing controlled HTML elements to be injected into the login page. This leads to JavaScript execution in the site domain, and when an authenticated administrator visits a prepared page, the attacker can abuse the existing session to authorize application credentials and upload arbitrary PHP code. The patch is included in WordPress 7.0.3 released on August 6, with backports available for branches as old as 4.7. No public exploitation has been confirmed yet, but the technical details make immediate updating a priority for site administrators.

WordPress 7.0.3 Addresses 12 Vulnerabilities Including Reflected XSS Leading to PHP Execution

WordPress has released version 7.0.3 to fix multiple security issues discovered in the content management system. The update, announced on August 6, 2026, resolves 12 vulnerabilities covering cross-site scripting, privilege escalation, information disclosure, and server-side request forgery. One issue tracked as CVE-2026-64638 is a reflected XSS flaw on the login page that can be exploited without authentication. Under specific conditions the vulnerability allows an attacker to execute PHP code on the affected site. The flaw received a CVSS v4.0 base score of 8.9 and is rated High severity. Administrators are urged to apply the update immediately.