WordPress 7.0.3

WordPress Login Page Exposed to Critical XSS2Shell Flaw CVE-2026-64638: Over 11,000 Sites Attacked Across 67 Countries

WordPress core login page vulnerability CVE-2026-64638 enables unauthenticated attackers to trigger reflected XSS that can escalate to full server compromise. The flaw stems from mismatched HTML sanitization between two filtering layers on the wp-login.php page, allowing malicious payloads to execute in the site origin. Imperva observed automated campaigns hitting more than 11,000 sites with hundreds of thousands of requests, predominantly affecting U.S. targets in gaming, education, and finance sectors. Successful exploitation chains the XSS into WordPress REST API and application password creation when an administrator is logged in, ultimately allowing malicious plugin uploads. Official patches are available in WordPress 7.0.3 and backported releases down to 4.7; administrators are urged to verify versions, audit user accounts, and inspect plugin directories immediately.